Active exploitation is concentrating on identity, email, backup and DevOps control planes. Cisco ISE, Cisco Secure Email Gateway, GitLab and Acronis require emergency action; WSO2, BIND and Oracle need accelerated remediation. CHOSEN BRICK remains targeted endpoint risk.