Skip to content
NewA calmer, faster ZeroHour
StoryResearchmediumExploited in the wild

Rapid7: High-severity flaws exploited in three days in Q3

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Rapid7’s Q3 2026 report says high-severity flaws were exploited in three days on average, with ransomware still dominant.

Rapid7’s Q3 2026 threat report says high-severity vulnerabilities were exploited an average of three days after public disclosure, with 71% of tracked exploitation within seven days, 80% within 14, and 90% within 30. It tracked 43 newly exploited high- and critical-severity flaws, 7% fewer than Q2 but 19% above a year earlier; 34 needed no authentication or user interaction. Ransomware remained the main threat, led by claimed activity from The Gentlemen and Qilin, and the United States was the most targeted country. AI was an operational but not fully autonomous component in 8% of tracked reporting, according to Rapid7. SecurityWeek’s account says the US accounted for 60% of attacks, while also stating the US share rose from 33% to 45%.

Key facts
  • Average disclosure-to-exploitation time for high-severity bugs was three days.
  • Exploitation shares: 71% within seven days, 80% within 14, 90% within 30.
  • Forty-three newly exploited high- and critical-severity flaws; 34 needed no login or interaction.
  • Claimed ransomware leaders were The Gentlemen and Qilin; top sectors were services, manufacturing, healthcare.
  • SecurityWeek says North Korea used Linux toolkit ted against South Korean organizations.
  • Rapid7 found 41 underground posts advertising RDP or network access.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Rapid7 BlogAdds 14- and 30-day shares, quarterly comparison, and 41 access posts.
  • SecurityWeekAdds ransomware groups, country and sector figures, and toolkit ted.
Vendors
Rapid7
Products
HAProxy
Threat actors
The GentlemenQilinINC RansomSandwormLazarusAPT31
Malware
ted
Organizations
Rapid7
Countries
United StatesGermanyItalyCanadaRussiaChinaNorth KoreaSouth Korea

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Rapid7 BlogFirst report

    Rapid7: high-severity flaws exploited three days after disclosure

    Of 43 newly exploited high- and critical-severity bugs in Q3, 34 needed no authentication or user interaction.

  2. · 4d ago SecurityWeek

    Rapid7: high-severity flaws exploited within three days in Q3

    The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.