Don’t swing at everything
Summary: Cisco Talos reports 49% year-over-year growth in CVEs in 2026 Q2, tracking close to 200 CVEs per day by the end of June, while KEVs grew only 13%. It also details msaRAT, a Rust-based remote access trojan built on the Tokio runtime that the Chaos ransomware group uses to hijack Chrome or Edge via the Chrome DevTools Protocol, delivered through an MSI file disguised as a Windows update.
Key Takeaway: 181 days into 2026, 46% of actively exploited KEV CVEs still trace back to 2025 or earlier, and of the roughly 3,700 CVSS 9+ CVEs, 95% sit below 5% EPSS, so patching by severity alone misdirects effort away from what is actually being exploited.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026