Critical Zero-Days, Active Exploitation, and Management-Surface Exposure

CISA added ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to KEV on October 11, alongside continuing exploitation of Citrix NetScaler CVE-2026-88779 and Cisco SD-WAN Manager CVE-2026-76504. AnyDesk Linux exploitation, PaperCut pre-authentication RCE reporting, Atlassian Data Center exploitation, Splunk's critical Patroni flaw, Cisco NX-API root RCE, and rapid post-disclosure scanning reinforce immediate patching, exposure reduction, credential review, and retrospective hunting.