GreyNoise's public Oct 5-13 brief reports that the number of IPs trying CVE-2026-72898 (unauthenticated SQL injection via Metabase's /reset_password database endpoint, KEV since Aug 11) more than tripled starting Oct 11, and every one of them was malicious. Each Metabase instance holds credentials for the databases it queries, so check exposed Metabase for odd reset_password requests and new admin accounts, and rotate the stored database credentials if you find either. Separately, about a thousand malicious IPs ran a ProxyNotShell (CVE-2022-41040/41082) check against Exchange on every odd-numbered day, 42-44 hours apart. If your logs show that rhythm, you're on the list, so confirm your Exchange is patched. GreyNoise also saw IPs trying factory telnet accounts on Dasan and D-Link gateways jump about 22-fold.