Loading story…
Rapid7 reported that AI-driven vulnerability discovery and faster attacker operationalization are outpacing traditional patch management, with high and critical vulnerability disclosures rising from 4,268 in Q2 2025 to 8,539 in Q2 2026. Newly exploited vulnerabilities also increased 8% to 40, and 25 of those were so-called "Holy Grail" flaws requiring neither credentials nor user interaction, underscoring how quickly attackers can capitalize on high-impact exposures. The report also linked the pressure to persistent nation-state activity from China, Russia, Iran, and North Korea, alongside continued ransomware operations by groups including Qilin, The Gentlemen, DragonForce, Akira, and LockBit.
Health-ISAC said the problem is especially acute in healthcare, where patching delays are often built into clinical operations because updates may require vendor validation, hospital testing, scheduled downtime, change-control approval, and sometimes regulatory review. Systems such as MRI platforms can remain exposed while those processes play out, giving attackers time to exploit weaknesses that AI helps identify and weaponize faster. Both reports said organizations should move beyond monthly patch cycles and CVSS-only prioritization, and instead focus on reducing reachable, high-impact exposure during the window when patches cannot yet be deployed.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
In an article published on August 19, 2026, Health-ISAC said healthcare organizations face structural patching delays due to vendor validation, hospital testing, downtime scheduling, and possible regulatory review. It recommended reducing attacker reach and managing exposure while patches cannot yet be applied.
Rapid7 reported that the United States had 881 ransomware victims in Q2 2026, with Germany second at 91. It named Qilin, The Gentlemen, DragonForce, Akira, and LockBit as the most active ransomware groups.
Rapid7's Q2 2026 Threat Landscape Report said newly disclosed vulnerabilities with publicly available proof-of-concept code increased 76% compared with Q2 2025. The report warned that attackers can rapidly weaponize newly disclosed flaws using public information and tools.
Rapid7 said disclosures of high and critical vulnerabilities increased to 8,539 in Q2 2026, arguing that AI-driven discovery and faster attacker operationalization are compressing defenders' response windows.
Rapid7 reported that newly exploited vulnerabilities rose 8% year over year to 40 in Q2 2026. It also found that 25 of those 40 exploited flaws required neither credentials nor user interaction.
Rapid7 said 4,268 high and critical vulnerabilities with CVSS scores from 7 to 10 were disclosed in Q2 2025, providing the baseline for its later year-over-year comparison.
Rapid7 published analysis arguing that traditional monthly patch cycles and CVSS-based prioritization cannot keep pace with AI-driven vulnerability discovery and attacker speed. The report recommended prioritizing exposure, reachability, and impact instead.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcehealth-isac.org
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and industry commentators warned that AI is rapidly accelerating patch analysis and vulnerability discovery, making it easier to extract exploit-relevant details from public fixes before many organizations can remediate. Reporting on recent research highlighted how large language models and automated patch-diffing can identify patched executables, vulnerable functions, and likely root causes from vendor updates, while Linux-focused analysis said similar techniques can infer affected components and even help reproduce proof-of-concept conditions from public patches. Examples cited include Akamai’s **PatchDiff-AI** work on Windows updates and **K-Repro** research that reproduced dozens of `KernelCTF` vulnerabilities from patch data. The coverage said defenders are struggling with incomplete vulnerability intelligence and weak automation inputs, especially when advisories lack timely, machine-readable metadata. One example involved **CVE-2026-7473** in **Arista EOS**, which was reportedly exploited in the wild but did not appear in public CVE databases for about a month after Arista published its advisory; Arista also issued configuration-based mitigations rather than a software patch, limiting the usefulness of version-only scanners. The reports argued that organizations need stronger configuration monitoring, intrusion detection, threat hunting, and better vendor support for structured advisory formats such as **CSAF** to keep pace with AI-enabled attackers.
Aug 1, 2026
Researchers and security leaders at **Black Hat USA 2026** warned that AI is sharply increasing the rate of software vulnerability discovery, raising concerns that defenders may struggle to keep pace with disclosure and remediation. The discussion highlighted research from Arizona State University led by Yan Shoshitaishvili, which found that AI-assisted workflows and training on characteristics of previously identified bugs significantly boosted the number of flaws uncovered. The surge in findings is colliding with growing defensive pressure, including high recent Microsoft Patch Tuesday `CVE` volumes and the U.S. government's new **Gold Eagle** initiative to coordinate vulnerability research, mitigation, and fixes. Speakers cautioned that discovery may now be outpacing responsible disclosure and patching capacity, increasing the risk of exposed systems and hurried fixes, while also arguing that sustained AI-driven research could eventually reduce long-standing bug backlogs and improve software security overall.
Aug 14, 2026
Oracle issued a record quarterly security update with **1,449 patches** across its product portfolio, while also shifting to monthly Critical Security Patch Updates for the most severe flaws. The company said the surge is tied largely to AI-assisted internal vulnerability discovery, and the release includes multiple high-risk issues such as `CVE-2026-47056` and `CVE-2026-60217`, both rated **CVSS 10.0** and described as remotely exploitable without authentication, alongside serious Oracle Database Server flaws including `CVE-2026-61211` and `CVE-2026-47040`. Government and industry warnings say organizations should expect a broader **patch wave** as AI accelerates both vulnerability discovery and attacker exploitation. Research on **1,646** open source CVEs linked to multiple patches found that remediation often spans several commits rather than a single fix, with **641** cases involving incomplete initial patches and **31.7%** of multi-patch fixes taking more than a day to complete, leaving residual exposure. Security agencies are urging defenders to prioritize internet-facing and critical systems, isolate or replace unsupported technology, and verify whether follow-up or branch-specific patches are still pending instead of assuming the first published fix fully closes the risk.
Jul 27, 2026