--- title: New Report from Rapid7 Labs: Why Q2 2026 signals the end... description: Rapid7 Labs' Q2 2026 Quarterly Threat Landscape Report finds that vulnerability disclosures nearly doubled year over year (8,539 high/critical CVEs vs 4,268),... canonical: https://daily.dev/posts/new-report-from-rapid7-labs-why-q2-2026-signals-the-end-of-traditional-patch-cycles-flleyobem twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles | daily.dev og:description: Rapid7 Labs' Q2 2026 Quarterly Threat Landscape Report finds that vulnerability disclosures nearly doubled year over year (8,539 high/critical CVEs vs 4,268),... og:url: https://daily.dev/posts/new-report-from-rapid7-labs-why-q2-2026-signals-the-end-of-traditional-patch-cycles-flleyobem og:image: https://api.daily.dev/og/posts/FLLEyoBem.png og:image:alt: New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 4 min read · 0 upvotes · 0 comments ## Summary Rapid7 Labs' Q2 2026 Quarterly Threat Landscape Report finds that vulnerability disclosures nearly doubled year over year (8,539 high/critical CVEs vs 4,268), while exploited-vulnerability counts held steady around 40. Nearly two-thirds of exploited vulnerabilities required no user interaction, missing-authentication disclosures (CWE-306) jumped 247% YoY, and Qilin led ransomware activity with 263 victims. The report argues traditional patch-everything cycles can't keep pace and recommends prioritizing based on reachable exposure rather than severity scores alone, alongside continued nation-state APT activity and social-engineering techniques like ClickFix and fake CAPTCHA campaigns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many high and critical severity CVEs were disclosed in Q2 2026 compared to the previous year? There were 8,539 new high- and critical-severity CVEs (CVSS 7.0-10.0) disclosed in Q2 2026, double the 4,268 reported in the same quarter of the prior year. Despite this surge in disclosures, the number of newly exploited vulnerabilities stayed roughly steady at around 40, showing disclosure volume is outpacing actual exploitation activity. _Security teams triaging a growing CVE backlog can follow vulnerability trend coverage on daily.dev._ ### What percentage of exploited vulnerabilities in Q2 2026 required no user interaction? Nearly two-thirds, 62%, of exploited vulnerabilities in Q2 2026 required no user interaction such as stolen credentials or phishing clicks, up nine points from 53% in Q2 2025. Disclosures of missing-authentication flaws (CWE-306) also surged 247% year over year, expanding the pool of internet-facing systems attackers can reach without logging in. _Anyone prioritizing which exposures to close first can track these attack-surface shifts on daily.dev._ ### Which ransomware group had the most victims in Q2 2026? Qilin led ransomware activity in Q2 2026 with 263 listed victims, and the United States remained the most heavily targeted country, with business services and healthcare among the hardest-hit sectors. Incident response teams also observed growing use of ClickFix, fake CAPTCHA campaigns, and social engineering via platforms like Microsoft Teams, accounting for 31.8% of worked incidents. _Teams assessing ransomware risk by sector can follow quarterly threat landscape updates on daily.dev._ ## Similar posts on daily.dev - [Analyzing the vulnerability landscape in Q3 2025](https://daily.dev/posts/analyzing-the-vulnerability-landscape-in-q3-2025-ies7snyn2) · Securelist · 0 upvotes · 0 comments - [When Attacks Come Faster Than Patches: Why 2026 Will be the Year of Machine-Speed Security](https://daily.dev/posts/when-attacks-come-faster-than-patches-why-2026-will-be-the-year-of-machine-speed-security-ox6dyhwob) · The Hacker News · 0 upvotes · 0 comments - [July 2026 CVE Landscape](https://daily.dev/posts/july-2026-cve-landscape-iupqvq66f) · Recorded Future Blog · 0 upvotes · 0 comments - [Vulnerability exploits now dominate intrusions](https://daily.dev/posts/vulnerability-exploits-now-dominate-intrusions-6prcq9dmw) · The Register · 0 upvotes · 0 comments - [Vulnerabilities have become cyber attackers’ No. 1 door to the enterprise](https://daily.dev/posts/vulnerabilities-have-become-cyber-attackers-no-1-door-to-the-enterprise-ybhmgdbuz) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/new-report-from-rapid7-labs-why-q2-2026-signals-the-end-of-traditional-patch-cycles-flleyobem) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles","url":"https://daily.dev/posts/new-report-from-rapid7-labs-why-q2-2026-signals-the-end-of-traditional-patch-cycles-flleyobem","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-report-from-rapid7-labs-why-q2-2026-signals-the-end-of-traditional-patch-cycles-flleyobem"},"datePublished":"2026-08-18T13:20:51.601Z","dateModified":"2026-08-18T14:27:35.092Z","description":"Rapid7 Labs' Q2 2026 Quarterly Threat Landscape Report finds that vulnerability disclosures nearly doubled year over year (8,539 high/critical CVEs vs 4,268),...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef97cdf4047530697ddaf703405f32ef?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef97cdf4047530697ddaf703405f32ef?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-report-from-rapid7-labs-why-q2-2026-signals-the-end-of-traditional-patch-cycles-flleyobem","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-report-from-rapid7-labs-why-q2-2026-signals-the-end-of-traditional-patch-cycles-flleyobem#faq","mainEntity":[{"@type":"Question","name":"How many high and critical severity CVEs were disclosed in Q2 2026 compared to the previous year?","acceptedAnswer":{"@type":"Answer","text":"There were 8,539 new high- and critical-severity CVEs (CVSS 7.0-10.0) disclosed in Q2 2026, double the 4,268 reported in the same quarter of the prior year. Despite this surge in disclosures, the number of newly exploited vulnerabilities stayed roughly steady at around 40, showing disclosure volume is outpacing actual exploitation activity. Security teams triaging a growing CVE backlog can follow vulnerability trend coverage on daily.dev."}},{"@type":"Question","name":"What percentage of exploited vulnerabilities in Q2 2026 required no user interaction?","acceptedAnswer":{"@type":"Answer","text":"Nearly two-thirds, 62%, of exploited vulnerabilities in Q2 2026 required no user interaction such as stolen credentials or phishing clicks, up nine points from 53% in Q2 2025. Disclosures of missing-authentication flaws (CWE-306) also surged 247% year over year, expanding the pool of internet-facing systems attackers can reach without logging in. Anyone prioritizing which exposures to close first can track these attack-surface shifts on daily.dev."}},{"@type":"Question","name":"Which ransomware group had the most victims in Q2 2026?","acceptedAnswer":{"@type":"Answer","text":"Qilin led ransomware activity in Q2 2026 with 263 listed victims, and the United States remained the most heavily targeted country, with business services and healthcare among the hardest-hit sectors. Incident response teams also observed growing use of ClickFix, fake CAPTCHA campaigns, and social engineering via platforms like Microsoft Teams, accounting for 31.8% of worked incidents. Teams assessing ransomware risk by sector can follow quarterly threat landscape updates on daily.dev."}}]} ```