Loading story…
VulnCheck reported that exploitation is moving faster in the first half of 2026, with the median time from CVE publication to inclusion in the Known Exploited Vulnerabilities (KEV) catalog falling from 120 days in 2025 to 80 days. The firm said about 200 CVEs were exploited within 31 days of publication, showing that early exploitation remained steady even as total CVE volume increased. Of 495 KEVs tracked in H1 2026, content management systems accounted for nearly one-third of cases, led by the WordPress plugin ecosystem, while network edge devices remained another heavily targeted category. The report also identified AI products as an emerging attack surface, including LangFlow flaws used for initial access, credential harvesting, cryptomining, and attempted lateral movement.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
On its publication, VulnCheck released its first-half 2026 exploitation report, concluding that AI-assisted vulnerability discovery was not producing disproportionately exploited flaws. The report said 14 of 1,061 AI-attributed vulnerabilities were confirmed exploited in the wild, roughly matching the broader exploitation rate.
CyberScoop says Microsoft’s July Patch Tuesday included a record 622 vulnerabilities, following 206 in June. The article presents this as a possible indicator that AI-assisted discovery may increase disclosure volume later in 2026.
CyberScoop reports that Microsoft disclosed 206 vulnerabilities in its June Patch Tuesday release. The figure is cited as part of a broader rise in disclosure volume that could reflect AI-driven vulnerability discovery.
The reporting says major AI vulnerability-hunting systems including Anthropic’s Project Glasswing, Microsoft’s MDASH, and OpenAI’s Daybreak launched in April or May 2026. The article cites these launches as too recent to judge their longer-term impact on exploitation trends.
VulnCheck reported that in the first half of 2026, the median time from CVE publication to KEV status fell to 80 days from 120 days in 2025, while about 200 CVEs were exploited within 31 days of publication. The analysis also found content management systems, especially WordPress plugins, remained the most targeted category and identified AI products as an emerging attack surface.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceinfosecurity-magazine.com
Open sourcecyberscoop.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and research highlighted accelerating exploitation pressure on enterprises, driven by both **zero-day** activity and the growing backlog of **known exploited vulnerabilities (KEVs)**. A Talos retrospective counted **48,196 CVEs in 2025** and **241 KEVs** (up from 186 in 2024), with a notable share of KEVs originating from older CVEs and even vulnerabilities dating back to 2007—reinforcing that attackers continue to monetize long-lived weaknesses when patching and asset visibility lag. Talos also noted disproportionate exploitation targeting **network edge infrastructure** (e.g., firewalls/VPNs), underscoring the operational risk of unpatched or hard-to-patch appliances and legacy systems. Separate threat reporting pointed to expanding attack volume and shifting attacker tradecraft that can amplify exploitation impact. Check Point data cited by Dark Reading said **Latin America** is seeing substantially higher weekly attack volume than the US (including higher proportions of **ransomware** and **infostealer** activity), consistent with adversaries concentrating on regions with faster digital adoption and lower security maturity. CSO Online also reported that the *Coruna* **iOS exploit kit** rapidly evolved from a targeted spyware capability into broader criminal use, illustrating how advanced exploitation tooling can commoditize quickly and increase the likelihood of opportunistic compromise across a wider victim set.
Jun 29, 2026
Security teams are increasingly de-emphasizing *CVSS-only* approaches in favor of prioritizing **known exploited vulnerabilities (KEV)**, driven by evidence that only a small fraction of disclosed CVEs are exploited in the wild. Reporting citing VulnCheck research highlighted that roughly **1% of 40,000+** vulnerabilities disclosed in the prior year saw in-the-wild exploitation, with **network edge devices** disproportionately targeted (reported as **28%** of KEV-impacted products) and recurring exposure across major enterprise stacks including **Microsoft, VMware, Oracle, Ivanti, SonicWall, and Fortinet**. The same research pointed to high-profile exploitation waves such as **SharePoint zero-days** impacting **400+ organizations** and rapid weaponization dynamics like **React2Shell**, which reportedly accumulated **236 public exploits** within a month. In the UK public sector, the Department for Science, Innovation and Technology (DSIT) reported operational improvements from a centralized **Vulnerability Monitoring Service** that continuously scans internet-facing systems across roughly **6,000 organizations** and drives remediation of about **400 confirmed vulnerabilities per month**. DSIT said median remediation time for critical domain-related weaknesses fell to **eight days** (from ~50), other vulnerabilities to **32 days** (from 53), and the backlog of unresolved critical flaws dropped by about **three-quarters**—positioning automated discovery and faster patch cycles as a practical response to long-standing government security shortfalls, even as officials did not quantify exploitation rates or overall compromise trends.
Jun 29, 2026
Security researchers and industry analysts report that the number of published vulnerabilities (CVEs) remains high in late 2025, with a notable year-over-year increase in overall volume, despite a temporary slowdown in November attributed to administrative changes at major CVE Numbering Authorities (CNAs). Kaspersky's Q3 2025 analysis highlights that attackers continue to exploit flaws in widely used software such as WinRAR and Microsoft Office, and that the number of critical vulnerabilities (CVSS > 8.9) remains significant, though slightly lower than the previous year. The data suggests that the vulnerability landscape is both expanding and evolving, with attackers leveraging new and existing flaws for exploitation, particularly in Windows and Linux environments. Industry commentary emphasizes that fluctuations in monthly CVE counts are often driven by the operational pace of a few large CNAs, rather than a true reduction in underlying risk. The November 2025 dip in CVE disclosures is linked to internal migrations and process slowdowns at organizations like Patchstack, MITRE, and the Linux kernel ecosystem, rather than a decrease in actual vulnerabilities. Security teams are cautioned not to interpret short-term drops in disclosure volume as a sign of stabilization, as the overall trend points to continued growth in vulnerabilities and persistent exploitation by threat actors.
Jun 29, 2026