Bitdefender MDR's Oct 15 advisory (three customer incidents since ~Oct 7) stresses that v10.3.4.0 and v9.15.2.59 did not fully fix CVE-2026-105133/105134. In the console: System Settings → License → Update License and compare the full four-part Product Version. Patch, reboot, then assume prior compromise on any internet-reachable box since NVD publication (Oct 4): new/changed JSP under the Ahsay web root, java spawning powershell/cmd, .cmd drops in C:\Users\Public, unexpected OpenSSH installs, privilege changes, and outbound to staging like captcha-eyw[.]pages[.]dev or C2s MDR listed (e.g. 38.60.252[.]110). Patch closes the hole; it does not remove planted access. Federal KEV due date is Oct 17.