Threat Intel database growth, Sep 26-Oct 2
For September 26 through October 2, 2026, Production Threat Intel retained 11902 distinct public-source evidence records. The prior equal window, September 19 through September 25, retained 9277. The change is +2625, about +28.3%. The GROWING label on this card describes that overall increase; this note does not report movement in an individual curated class.
The count is the number of distinct public-source evidence entities with at least one source observation dated within the window. Multiple observations of the same entity count once. The same rule sets both windows. This is the retained-evidence total for the interval, not the number of attacks or newly discovered vulnerabilities.
Packaging reads the live evidence ledger through the Production evidence API (midkernel/evidence-api/v2). The date field on that read is source_effective. The measure is uniqueThreats. That read is the source of truth for the figures in this note. Each window is seven days. The current window is compared with the previous seven days on the windowed unique-threat total.
The card states the current unique-threat total, the prior unique-threat total, the difference, and the seven daily counts. Its source line is Midkernel Threat Intel, evidence-api/v2.
Daily counts
Daily unique-threat counts for this window, by source-effective day:
| Day | Unique threats |
|---|---|
| Sep 26 | 1103 |
| Sep 27 | 1236 |
| Sep 28 | 1753 |
| Sep 29 | 2020 |
| Sep 30 | 2139 |
| Oct 1 | 2115 |
| Oct 2 | 1622 |
September 30 is the peak day, at 2139. September 26 is the low day, at 1103. October 1 is close to the peak, at 2115. Counts rise from September 26 to the September 30 peak, stay near that level on October 1, and finish the window on October 2 at 1622.
The same entity can have source observations on more than one day, so daily counts overlap. The week total deduplicates entities across September 26 through October 2; each daily row deduplicates them within that source-effective day.
Part of the week-over-week increase is same-window backfill: late-arriving records on the newest days, with ingest settled before this note.
Method
Equal windows, the Production evidence query, and the selection rules for curated-class posts are set out in How Midkernel Threat Intel publishes. This note records the overall database totals from the company account's published card for this window on X. The live board is Threat Intel.