High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

Rapid7's Q3 2026 report analyzes the current cyber threat landscape, emphasizing that high-severity vulnerabilities are exploited quickly, often within days of disclosure. Most exploited vulnerabilities are remote and do not require credentials or local user interaction. Ransomware attacks dominate, with notable groups such as The Gentlemen and Qilin responsible for many incidents. The US is the primary target, followed by Germany, Italy, and Canada. AI's operational role in attacks remains limited to 8% of incidents, mainly supporting automation of attack steps rather than autonomous exploitation. Nation-state APT groups continue targeting government and critical infrastructure sectors, employing advanced tools including a newly identified Linux toolkit used by North Korean actors. The dark web remains active with access brokers selling compromised accounts and network footholds. The report suggests defenders monitor AI API usage for anomalies and prepare for an eventual rise in AI-assisted attacks.

High-severity vulnerabilities are exploited rapidly, increasing risk exposure shortly after disclosure. Ransomware continues to impose significant operational and financial impacts across multiple sectors worldwide, especially in the US. The involvement of AI in attacks is currently limited but growing in automation of attack processes, potentially increasing attack efficiency. Nation-state actors maintain persistent threats against government and critical infrastructure sectors, using sophisticated malware and espionage tools. The active dark web market for compromised credentials and exploits facilitates attacker capabilities and attack frequency.

No specific patches or fixes are detailed in this report. Defenders should monitor for unusual AI API usage patterns from unexpected hosts or processes as an early detection measure. Awareness of rapid exploitation timelines underscores the importance of timely vulnerability management and patching based on vendor advisories. Monitoring dark web activity for relevant threat intelligence can provide early warnings of emerging threats. Organizations should maintain vigilance against ransomware threats and nation-state actor tactics, adapting defenses accordingly.