If your organization patches once a month, Rapid7's latest numbers show how often that leaves you exposed. According to the company's Q3 2026 Quarterly Threat Landscape Report, attackers exploit high-severity vulnerabilities an average of three days after public disclosure. Seventy-one percent of the exploitation Rapid7 tracked started within the first week.
The report, which trade press covered this week, also says what kind of flaw attackers prefer. Most of the newly exploited bugs needed no password and no click from a victim. Put plainly, they were vulnerabilities an attacker could use from the internet against a system nobody was touching.
The exploitation clock
The timeline numbers matter most. Help Net Security reports an average of three days from disclosure to exploitation for high-severity flaws, with 71% of tracked exploitation inside the first week.
Douglas McKee of Rapid7 gave CSO Online a similar figure: defenders get roughly 72 hours before a flaw is used in the wild. Think about what that means for a typical monthly cycle. A bug disclosed the day after Patch Tuesday may well be exploited, if attackers want it at all, before the next maintenance window comes around.
Remote, unauthenticated, zero-click
Rapid7 counted 43 newly exploited high- or critical-severity vulnerabilities in the quarter. CSO Online notes that this is up 19% year on year. Of those 43, 34 needed neither authentication nor user interaction. That is about 79%, or close to four in five.
Some definitions, since vendors use these terms loosely:
- Unauthenticated means the attacker needs no account, password or session on the target. Being able to reach the vulnerable service is enough.
- No user interaction (often called "zero-click") means nobody has to open an attachment, visit a link or approve a prompt. Security awareness training does nothing against these flaws.
- Remote means the attack comes over the network, usually against an internet-facing service.
McKee's main argument, as CSO Online reports it, is that the supply of exploitable flaws is growing faster than attackers' use of them. New CVEs rated 7 to 10 on the severity scale rose 133% year on year. Publicly available proof-of-concept code rose about 86%. Exploitation grew too, but more slowly, and it stayed concentrated in one profile: remote, unauthenticated and zero-click. Rapid7's advice is to build defenses around that profile instead of trying to treat every high CVSS score the same way.
The underground mostly resells known bugs
Rapid7 also looked at criminal forums. Help Net Security reports that of 63 underground posts the company analyzed, 41 advertised RDP or network access to compromised organizations. Fourteen involved exploits or purported zero-days.
Those zero-day claims should be read with caution. CSO Online reports that the underground posts mostly referenced CVEs already published in vendor advisories or in CISA's Known Exploited Vulnerabilities (KEV) catalog. Rapid7 reads this as criminals quickly repackaging known flaws, not selling genuinely new ones. Sellers' claims of novel zero-days remain unverified. They come from the sellers themselves.
This works in defenders' favor. If most of what is sold is already on KEV, then tracking KEV closely and patching it quickly removes a large share of what the market offers.
Nation-state activity
According to Help Net Security, Rapid7 linked 15 of the quarter's vulnerabilities to six threat actors or clusters. Their targets spanned government, defense, aerospace, transportation, finance, energy, healthcare and technology. Rapid7's attributions include:
- A toolkit Rapid7 links to North Korea that included a modified HAProxy backdoor, used against South Korean automotive and media organizations.
- Activity by Void Blizzard, which Rapid7 describes as Russia-linked.
- Operation C-Major, which Rapid7 describes as Pakistan-linked.
These attributions are Rapid7's, as reported by Help Net Security.
AI is less of a factor than the hype suggests
Rapid7's data on AI is restrained. Christiaan Beek, VP of Rapid7 Intelligence, told Help Net Security that AI appeared as an operational component in only 8% of tracked reporting.
McKee told CSO Online where AI does show up: it ran the "tactical middle" of attacks, while humans still chose the targets. On Rapid7's evidence, AI has not replaced the human operator.
Ransomware: government targets and leak-site volume
Help Net Security reports that ransomware incidents against government bodies in the top 10 reporting countries rose from 48 to 55, an increase of 15%. The United States' share grew from 33% to 45%, which is 16 to 25 incidents.
Rapid7 counted 1,112 US listings on ransomware leak sites in the quarter. By volume, The Gentlemen led with 342 listings, followed by Qilin with 339 and INC Ransom with 99. Leak-site listings are claims made by the gangs. A listing does not mean the victim has confirmed a breach or that data was actually stolen, so treat the counts as a measure of gang activity and not as verified compromises.
A live example: the PHP advisory
SMBtech connected the report to a concrete case: Rapid7's advisory on two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSSv4. According to SMBtech, they affect PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. SMBtech's headline warns that the flaws could expose millions of web servers to remote takeover. Rapid7 urged emergency patching outside normal maintenance cycles. SMBtech reports that PHP has released fixes across supported branches: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. That is the report's three-day finding turned into an instruction.
What It Means for Defenders
Who is affected: Any organization running internet-facing services. That covers VPN gateways, web servers, remote access tools and anything else reachable without logging in. Organizations with limited patching staff that rely on monthly cycles are likely the most exposed to the gap Rapid7 describes.
What to do:
- Run two patch tracks. Keep the monthly cycle for routine updates. Add an emergency track for flaws that are remote, unauthenticated and zero-click on systems exposed to the internet, with a target of days, not weeks. Given a roughly 72-hour window, that track needs to move fast.
- Prioritize by exposure profile, not CVSS alone. With high-severity CVEs up 133% year on year, you cannot treat every 7+ score as an emergency. Ask three questions: Is it reachable from the internet? Does it require authentication? Does it require user interaction? A yes to the first and no to the other two puts it on the emergency track.
- Watch CISA KEV closely. Rapid7 found that underground sellers mostly repackage flaws already in vendor advisories or KEV. Patching KEV entries quickly removes much of what the criminal market sells.
- Lock down RDP and remote access. 41 of 63 underground posts advertised RDP or network access. Review which remote access services are exposed, require MFA, and check for credentials that should be rotated.
- Patch PHP now. If you run PHP through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed, treat CVE-2026-109618 and CVE-2026-109619 as an out-of-cycle emergency, as Rapid7 urges. Apply your vendor's or distribution's fixed packages as soon as they are available. Shared hosts and managed WordPress customers should confirm with their provider that the update has been applied.
- Know your attack surface. You cannot patch an exposed service you don't know about. An up-to-date inventory of internet-facing assets is what makes a three-day response possible.
Rapid7's overall point is that attackers are not working through the whole CVE list. They pick the small set of bugs that can be exploited from the internet without credentials and without a victim's help, and they use them within days. Patch programs that are built around that profile, and fast enough to match it, will cover most of the risk.
