Public-Facing Application Attacks Are Now the Initial Access Problem | Qualys
Summary: IBM X-Force's 2026 Threat Intelligence Index reports that exploitation of public-facing applications is now the most common initial access vector, with a 44% year-over-year increase in attacks beginning that way. Vulnerability exploitation accounted for 40% of observed incidents, and 56% of disclosed vulnerabilities required no authentication to exploit.
What's compelling: An unauthenticated application flaw gives an attacker a straight line from scanning to impact without phishing or credential theft, and Anthropic's Project Glasswing research cited here says Claude Mythos Preview identified 23,019 zero-day vulnerabilities, including 6,202 high- or critical-severity findings, with many exploit paths developed autonomously.
Read the original at Qualys Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026