Cyber Threats 2026 in Hard Numbers: A New Vulnerability Every 6 Minutes, Exploits Before the Patch

In 2018, an average of 63 days passed between the public disclosure of a vulnerability and the first attack. Today that number is minus seven. No, that’s not a typo — on average, attackers start exploiting a hole a week before the vendor ships a patch. And while that’s happening, the world adds a new vulnerability to the public catalog every 6 minutes on average. 💥

In my line of work I look at threat intelligence reports a lot — partly because it’s part of the job, partly out of professional curiosity. And for quite a while now I’ve had the impression that the numbers in them don’t come together into a single picture for people. Each one floats around on its own: someone posts a CVE chart here, someone else an AI-phishing percentage there. So I decided to gather in one place the data that best shows how much the playing field has changed — how many vulnerabilities we’re finding, how fast they become weapons, how many holes the biggest players are patching, how many new bugs we’re producing ourselves, and what AI adds on top of all this.

I’m approaching the topic with academic rigor: every number here has a source and a year. And at the end — six takeaways that follow directly from this data for your company.

Table of Contents

1. How Many Vulnerabilities We’re Finding — and Why the Record Falls Every Year
2. Time From Vulnerability to Attack: From 63 Days to Minus Seven
3. Attacks Through Software Holes Are Snowballing: From 14% to 31% of Breaches in Two Years
4. How Many Holes the Giants Patch — Microsoft, Google & Co.
5. Where Do All These Bugs Come From? AI Writes Code Faster Than We Secure It
6. New AI Threats: Phishing, Deepfakes and Break-ins on Autopilot
7. Poland in Numbers: Over 700 Incidents a Day
8. What to Do About It — 6 Things That Follow Directly From the Data
9. FAQ

How Many Vulnerabilities We’re Finding — and Why the Record Falls Every Year

A quick explanation for the non-technical crowd: CVE is the public, worldwide catalog of vulnerabilities — every disclosed hole in software gets its own number (e.g. CVE-2026-12345), so that everyone talks about the same bug in the same language.

And that catalog is growing at a pace I would have called absurd just five years ago:

• 2022: 25,084 new vulnerabilities
• 2023: 29,066 (+16%)
• 2024: 40,313 (+39%)
• 2025: 48,449 (+20%)
• 2026, as of August 19: already 53,803 — more than in all of record-breaking 2025, with four and a half months of the year still to go. That’s exactly the one new vulnerability every 6 minutes.

(Numbers per cvedetails.com, by publication date in the NVD database, as of August 19, 2026. Other methodologies — e.g. Jerry Gamblin’s annual “CVE Data Review” — give values that differ by less than 1%; the direction is the same everywhere.)

FIRST — the organization that, among other things, develops the vulnerability risk scoring system — forecast 59,400 new CVEs for 2026, then in June raised the forecast to ~66,000. Among the reasons it explicitly lists AI-assisted vulnerability discovery. A bit of chronicler’s honesty so the numbers don’t clash: the forecast was made in June, before the summer acceleration, and the 53,800 counter is the state as of August 19 — not the end of the year. At the current pace (over 230 new CVEs a day), 2026 would close nearer to 85,000. Forecasts simply can’t keep up with reality. Add to that a fun fact from the “it nearly fell over” category: in April 2025 the CVE program almost ground to a halt because MITRE’s funding was expiring — the contract was extended literally the night before the deadline. Europe drew its own conclusion, and ENISA launched its own database, EUVD, operating under the NIS2 umbrella.

Now the most important part, so you don’t panic: only a fraction of this avalanche is actively exploited. Research by the Cyentia Institute and FIRST shows that about 6% of all published CVEs carry any traces of use in attacks at all. Out of 35,000 vulnerabilities from the first half of 2026, the list of actively exploited ones (the KEV catalog run by the US agency CISA — more on that in a moment) ended up with… 85 of them, i.e. 0.24%.

Lesson no. 1: Nobody — not you, not a corporation with a thousand admins — will patch 48,000 holes a year. And nobody has to. The winner isn’t the one who patches everything, but the one who knows which of their holes are actually being attacked and closes those first. The problem is that there’s less and less time to make that call — more on that below.

Time From Vulnerability to Attack: From 63 Days to Minus Seven

Time-to-exploit (TTE) is the average time from the public disclosure of a vulnerability to its first use in a real attack. Google Mandiant has been measuring it for years, and this data series is, for me, the most important chart in the entire industry:

• 2018–2019: 63 days
• 2020–mid-2021: 44 days
• 2021–2022: 32 days
• 2023: 5 days
• 2024: −1 day
• 2025: around −7 days (estimate from the M-Trends 2026 report)

How can time be negative? It’s simple and scary at the same time: a growing share of exploited vulnerabilities are zero-days — holes the attacker finds and exploits before the vendor even knows about them, so before any patch exists. Google Threat Intelligence Group counted 90 zero-days used in attacks in 2025 (78 a year earlier), with a record 48% share of enterprise products — including, ironically, security systems: VPNs, firewalls and other edge devices.

Zero-days aren’t the only reason, by the way. Patch gapping is at work too: in open source projects, a fix is sometimes visible in the public code repository several days before the official release — attackers diff the changes, reconstruct the bug from them and write an exploit before users even get the update (this classically happened with Chrome’s V8 engine). Then there’s the coordinated disclosure process itself: before the patch ships, the hole is already known to the reporting researcher, the vendor’s team, sometimes partners briefed ahead of release — and every one of those links has at some point been the source of a leak. And vendors quite often learn about a vulnerability precisely because someone detected an ongoing attack — only then do the patch and the CVE number come into existence, so the date of first exploitation by definition lands before “day zero”.

And once the patch is out? Still no peace:

• According to VulnCheck, 29% of vulnerabilities with confirmed exploitation in 2025 were attacked on the day the CVE was published or earlier.
• Palo Alto Unit 42 observes internet-wide scanning for vulnerable systems within fifteen minutes of a CVE announcement.
• My favorite example on a “human” scale: Cloudflare recorded attack attempts against a fresh hole in JetBrains TeamCity 22 minutes after the proof-of-concept code was published. In 22 minutes you can’t even get through a status meeting, let alone deploy a patch.
• For edge devices (VPNs, firewalls — everything that “sticks out” into the internet), the Verizon DBIR gives a median time to mass exploitation of 0 days.

On the other side of the barricade, the pace looks like this: the median time for companies to fully patch a vulnerability from the actively-exploited list is 43 days (DBIR 2026) — and only 26% of those vulnerabilities ever get fully patched at all. The result? In this year’s DBIR, vulnerability exploitation became the number 1 vector of initial access to companies for the first time in the study’s 19-year history (31% of breaches), dethroning stolen passwords.

And one more speed metric, this time after the break-in: CrowdStrike measured the average breakout time — the time it takes an attacker to “spread” through the network from the first compromised machine — at 29 minutes in 2025. The record holder: 27 seconds.

Want to watch this live? Check out zerodayclock.com — a dashboard aggregating data on more than 3,500 vulnerabilities exploited in the wild (CISA KEV + VulnCheck). It’s a measurement independent of Mandiant’s, on a different sample and a different methodology — and it shows exactly the same direction: for vulnerabilities from 2018, the average time to attack there was 2.3 years; for vulnerabilities from 2026 it’s already minus 23 hours (as of August 19, 2026). The median has broken through the one-week and one-day thresholds, and the one-hour threshold is expected to fall around 2027. The clock is ticking faster and faster — literally.

Lesson no. 2: The “patching window” as a concept has ceased to exist. On average the attack starts before the patch, and companies take weeks to patch what gets attacked in minutes. That’s why, alongside a patching plan, you need a plan for the situation where the patch doesn’t exist yet: reducing exposure, segmentation and detection. If breakout takes half an hour — and you can’t see the intruder within half an hour — the next place you’ll see them is on the invoice.

Attacks Through Software Holes Are Snowballing: From 14% to 31% of Breaches in Two Years

If vulnerabilities are piling up at record rates and time-to-exploit has gone negative, it should show up in the statistics of real break-ins. And it does — every large incident dataset points in the same direction: exploitation of software flaws is today the fastest-growing door into companies:

• Verizon DBIR (roughly 22,000 confirmed breaches): the share of vulnerability exploitation shot up from 14% (2024 edition) through 20% (2025) to 31% (2026) — more than double in two years and the number 1 vector for the first time in the report’s 19-year history, ahead of stolen passwords and phishing.
• IBM X-Force 2026: exploitation of internet-facing applications now accounts for 40% of handled incidents — the most common cause, +44% year over year.
• Google Mandiant: exploits are the most common intrusion vector for the sixth year running (32% of cases handled by their incident response teams).
• Coalition (a cyber insurer): 58% of ransomware claims start with the takeover of an edge device (VPN, firewall). That squares with the DBIR, where attacks on edge devices grew eightfold year over year.
• CrowdStrike: 88% of observed exploitation of vulnerabilities with public PoC code happened within 48 hours of its publication, and the number of zero-days exploited before disclosure rose 42% YoY.

The fuel for this avalanche is everything you’re reading about in this post: a record supply of vulnerabilities, negative time-to-exploit, AI assembling exploits in minutes — and edge hardware, which by its nature stands exposed to the internet — often without MFA and without EDR, i.e. the intruder-detection software that simply cannot be installed on such a closed “box” — yet with permissions to the entire network.

For the record, because honesty is mandatory: it’s not that social engineering has shrunk. Phishing is holding steady (~16% in the DBIR, 22% at Unit 42) and changing format — to vishing (+134% YoY per CrowdStrike), fake CAPTCHA pages (+563%) or a call to the helpdesk — and in data from the SMB sector (Sophos), identity is still the root of 67% of incidents, because there the attacker doesn’t exploit anything, they simply log in. The point is that exploits have caught up with social engineering and are growing the fastest of all vectors — a company today has to defend both fronts at once.

Lesson no. 3: The strongest momentum is on the exploit side. If you have edge hardware and public-facing applications, patching speed and testing are your priority number one — for exactly the reasons described in lesson no. 2. Just don’t fund it out of the budget for MFA and procedures: social engineering hasn’t let up, it has merely changed channels. The attacker will always pick the cheaper of your two fronts.

How Many Holes the Giants Patch — Microsoft, Google & Co.

I like this perspective, because it works best on people who still believe that “decent software has no bugs”. So let’s look at the richest companies in the world, with the best security teams money can buy:

• Microsoft, across its monthly Patch Tuesdays, patched 1,020 vulnerabilities in 2024 and 1,139 in 2025 (counting per the Zero Day Initiative), including 41 zero-days. And 2026 keeps breaking records: 570 fixes in July alone and around 400 in August. Interestingly, Microsoft itself admits that part of this avalanche is the work of an internal AI-based vulnerability hunting system — machines find bugs faster than humans.
• Google Chrome — the browser you’re reading this post in — received fixes for ~250 vulnerabilities in 2025, including 8 zero-days actively exploited in attacks. In 2026 Google threw AI at the hunt too: three consecutive Chrome releases patched a combined 1,442 security bugs, and a Gemini-based agent found, among other things, a sandbox hole that had been sitting in the code for 13 years. Google also describes an agent system with a separate critic agent that weeds out false alarms before a finding reaches humans.
• Mozilla (Firefox) — in its April releases alone fixed 423 security bugs, versus the typical 20–30 a month throughout 2025. 271 of them were found with the help of Claude Mythos Preview (the name straight from Mozilla’s technical write-up). An honest comment from Firefox’s CTO: the AI found nothing that an elite human researcher wouldn’t have found — but it found it in bulk, not at the pace of one hole a week.
• The Linux kernel — the kernel team published 432 CVEs in about 30 hours (July 19–20, 2026). For the record: the kernel assigns CVEs very generously (every fix that might have security implications), so these are not 432 critical holes — but the scale of the stream is impressive either way.
• Oracle — its July cumulative patch bundle (Critical Patch Update) is nearly 1,450 security patches covering 1,235 unique CVEs. Previous quarters: from 309 to 481. A more than fourfold jump in three months — Oracle doesn’t explain where it came from, but the pattern is identical to everyone else’s.
• Apple — no different: the small, “point” update iOS 26.6.1 of August 17, 2026 alone patches 42 vulnerabilities (most of them in WebKit, Safari’s engine). That’s what a routine update looks like today for a phone that “doesn’t need updating, because it works just fine”.
• CISA KEV — the catalog run by the US agency CISA of vulnerabilities known for certain to be exploited in real attacks (hence the name: Known Exploited Vulnerabilities) — today counts 1,674 entries, 245 of which were added in 2025. This is exactly the short list that patching should start from.

On top of these individual cases sits an aggregate measure. Epoch AI counted high- and critical-severity CVEs published by the 21 largest technology organizations (from Microsoft to the Apache project): in July 2026 there were around 2,500 — roughly five times the monthly record from before the April announcement of Claude Mythos Preview (around 490). The chart looks the same for everyone: flat for years, then a wall.

And here an important piece of honesty: AI didn’t write these holes. People did — over decades. This is the technical debt of the entire industry, which AI in the hands of skilled researchers is now starting to pay off in bulk. Very good news… with three catches I can see from the defender’s trenches:

• Regression risk: how do you deploy patches for several hundred vulnerabilities in one product without breaking anything? Without a test environment, a rollout order and a rollback plan — you don’t.
• Normalization: another week, another few hundred fixes. Alert fatigue is a real mechanism — and all it takes is missing the one that just landed on the KEV list.
• Growing asymmetry: the attacker needs just one hole; the defender has to handle them all. AI has increased the supply of holes and the tempo on both sides — except the attacker gets to pick and choose.

Lesson no. 4: If Microsoft, Google and Apple — with unlimited budgets — patch over a thousand holes a year in their own products, guess whether the application a subcontractor wrote for your company in six months is secure. Bugs in software are not a disgrace, they’re mathematics and statistics. The disgrace begins when nobody at your place is actively looking for those bugs — because then the first “tester” is a criminal. And the new, second half of this lesson for 2026: with fixes arriving by the hundreds, security also hinges on the update process — testing, ordering, rollback. AI is not a machine for spitting out CVEs; above all it amplifies those who know what to look for. Make sure you have people like that on your side too.

Where Do All These Bugs Come From? AI Writes Code Faster Than We Secure It

If records are falling on the vulnerability-detection side, it’s only fair to ask: how many new bugs are we introducing? Here, 2025 brought two studies that should hang above every CTO’s desk:

Veracode quizzed more than 100 AI models on 80 programming tasks with known security pitfalls. The result: 45% of tasks end in code with a vulnerability from the OWASP Top 10 list (the industry’s “greatest hits” chart of the most common application bugs). In Java the share exceeds 70%. And the most interesting part: successive, ever-newer models write code that is syntactically prettier — but not one bit safer.

Apiiro analyzed tens of thousands of code repositories at large corporations and calculated that AI-assisted developers deliver 3–4 times more code — but generate 10 times more security issues. The number of privilege escalation paths (i.e. ways to turn an ordinary account into an admin) in AI-produced code grew by 322%. AI beautifully eliminates typos and syntax errors — and in exchange mass-produces architecture and logic flaws, which are exactly the ones you can’t see at first glance.

Let’s close the loop: among the reasons for raising its CVE forecast for 2026, FIRST lists… AI-assisted vulnerability discovery (reports in GitHub Security Advisories alone grew 449% year over year). So: AI writes more vulnerable code, AI finds more vulnerabilities in other people’s code, and we — humans — stand in the middle with the same patching budget as always. One spoonful of honey: according to VulnCheck, out of more than a thousand vulnerabilities attributed to AI discoveries, only 1.3% have actually been used in attacks so far. So far.

Lesson no. 5: AI in programming is an excavator: it digs both foundations and pits faster. If your teams (or subcontractors) use AI for coding — and they do, even if they claim otherwise 😈 — then security review and testing must be part of the development process, not a one-off exercise after deployment.

New AI Threats: Phishing, Deepfakes and Break-ins on Autopilot

Attack volume has been growing for years: Check Point calculated that in 2025 the average organization fended off 1,968 attacks a week — 70% more than two years earlier, and in July 2026 the counter jumped to 2,336. But the raw number isn’t the novelty I find most interesting (and most frightening) professionally. The novelty is quality and automation:

Phishing is now written by AI, not a “Nigerian prince”. KnowBe4 estimates in this year’s report that 86% of phishing attacks are AI-assisted. A study described in Harvard Business Review showed that 60% of participants fell for phishing fully generated by AI — exactly as many as for messages written by human social engineering experts. The era of “you’ll spot the scam by the broken grammar” is definitively over.

Deepfakes have entered the office. Entrust — based on data from its identity verification systems — estimates in its Identity Fraud 2025 report that a deepfake fraud attempt happens on average every 5 minutes. The case of the design and engineering firm Arup from early 2024 remains the symbol. And it’s no urban legend: the incident was confirmed by Hong Kong police, and the company itself admitted that forged voices and likenesses were used. After a video call with deepfakes of his own CFO and colleagues, an employee executed 15 transfers totaling $25.6 million. He didn’t click a suspicious link. He saw his superiors “with his own eyes”.

Break-ins are switching to autopilot. Three documented milestones from the past dozen-plus months:

• “Vibe hacking”: Anthropic described an operation in which a single criminal used an AI agent to carry out data theft and extortion against 17 organizations in a month — the AI did reconnaissance, harvested credentials, analyzed victims’ finances and calculated the “optimal” ransom (demands reached $500,000). A one-person APT group.
• The first espionage campaign run mostly by AI: in November 2025 Anthropic disclosed a state-linked operation in which an AI agent did 80–90% of the work in attacks on ~30 targets, with a human making decisions at 4–6 points across the entire campaign.
• PromptLock — the first known ransomware powered by a local AI model (detected by ESET; fortunately it turned out to be a research project from NYU — but the concept is now public). Add to that frameworks like HexStrike-AI, after whose release criminals bragged about cutting the exploitation time for fresh vulnerabilities “from days to under 10 minutes”.

To round things out, a classic in a new edition: ransomware. In 2025, data from 7,458 victim companies (+30% year over year) was published on leak sites, and 73 new criminal groups appeared. Automation has lowered the barrier to entry on the dark side of the job market too.

Lesson no. 6: AI hasn’t invented a single new type of attack. It has done something worse: it stripped attacks of their cost and time, and raised their quality to a level where the “vigilant employee” stops being a safeguard. Vigilance has to be replaced by procedures that work even when a person believes their own eyes and ears — more on that in the “what to do” section.

Poland in Numbers: Over 700 Incidents a Day

To wrap up the data, a look at my home market, Poland — so nobody thinks this is only a Silicon Valley problem:

• CERT Polska received 658,320 reports in 2025 and registered 260,783 unique incidents — an increase of 152% year over year. That’s more than 700 incidents a day. Phishing and fraud reign (97% of incidents); criminals most often impersonated the online marketplaces OLX (28,500 incidents) and Allegro (22,500). The pace isn’t letting up in 2026: in July alone CERT registered 31,200 incidents (+12% YoY), and its warning list of dangerous domains has grown by 158,000 entries since January.
• According to Check Point, the average Polish organization fended off 1,854 attacks a week over the past year (+15% YoY) — a touch below the European average, but the direction is the same.
• KPMG in its “Cybersecurity Barometer 2026” (a survey of 100 medium and large companies): 96% of Polish companies recorded at least one security incident in 2025. A record in the survey’s 9-year history.
• And how about resilience? In the “Cybersecurity — Trends 2026” report (Xopero), only 29% of companies declare high or very high cyber resilience, and 64% have no cyber insurance.

Lesson no. 7: Put those two numbers side by side and they say it all: 96% of companies had an incident, 29% declare high resilience. The question “will I get attacked” has been statistically settled. Two other questions remain open: will you notice it and how much will it cost you.

What to Do About It — 6 Things That Follow Directly From the Data

I won’t leave you with charts alone. Every point below follows directly from the numbers above — no philosophy:

1. Inventory everything that “sticks out” into the internet. The median time to mass exploitation of edge devices is 0 days, and nearly half of 2025’s zero-days targeted enterprise gear — VPNs and firewalls. If you don’t have an up-to-date list of your own systems visible from the internet, an attacker will make one for you (in fifteen minutes, as you’ll recall).
2. Patch by risk, not by count. 48,000 CVEs a year vs 245 new entries on the list of actually exploited ones (KEV). Critical and internet-facing — within 24–72 hours; manage the rest as a process. A median of 43 days to patch an actively attacked hole is, these days, asking for trouble.
3. Have a plan for when there is no patch. If the average time-to-exploit is negative, some attacks will by definition arrive before the patch. Limit the exposure of services, segment the network, prepare kill switches (“what can we cut off within an hour without killing the business?”).
4. Invest in detection, not just walls. Breakout time is 29 minutes, and an access handoff between criminals can take 22 seconds. Monitoring (your own SOC, an MDR service — whatever fits the scale of your company) that actually looks at alerts at night and on weekends has stopped being a corporate luxury.
5. Deepfake-proof procedures. If 60% of people fall for AI-written phishing and “the CEO on video” can be generated — no single person should be able to execute an unusual transfer or change a contractor’s bank account details. A callback to a known number, a second signature, limits. Boring? Boring is exactly what saves millions.
6. Test yourself before someone else does. Microsoft and Google patch a thousand holes a year each because someone is actively looking for them. At your scale, that exact role is played by a penetration test (a controlled attack on your systems, after which you get a list of holes and ways to close them) or a bug bounty program. If you want to know what that costs at your scale — get the number in 2 minutes with my pricing calculator, and if you’d rather talk: get in touch.

FAQ

How many vulnerabilities (CVEs) were discovered in 2025?

48,449 new CVEs (cvedetails.com, per the NVD database; other tallies give 48,200–49,900). In 2026 the counter passed the entire previous year as early as August 19 (53,803). FIRST’s forecast for the whole of 2026: around 66,000.

What is time-to-exploit and what is it now?

It’s the average time from the public disclosure of a vulnerability to its first use in an attack. According to Google Mandiant’s research it fell from 63 days (2018–2019) to about minus 7 days in 2025 — attacks on average start before the patch is published, because the share of zero-days keeps growing.

How fast do criminals exploit newly disclosed vulnerabilities?

Internet scanning starts within about 15 minutes of a CVE announcement (Unit 42), ~29% of vulnerabilities with confirmed exploitation were attacked on the day of publication or earlier (VulnCheck, 2025), and for edge devices the median time to mass exploitation is 0 days (Verizon DBIR).

Are attacks through software flaws really growing?

Yes, fastest of all vectors: in the Verizon DBIR the share of vulnerability exploitation grew from 14% to 31% of breaches in two years (vector no. 1 for the first time in the report’s history), and at IBM X-Force it’s already 40% of incidents (+44% YoY). Phishing isn’t disappearing, though (16% in the DBIR, 22% at Unit 42) — it’s changing form to vishing and ClickFix, so both fronts have to be taken seriously.

Is code written by AI secure?

Not by default. Veracode: 45% of programming tasks completed by AI models end in code with a vulnerability. Apiiro: teams using AI write 3–4× more code but generate ~10× more security issues.

Why are record numbers of vulnerabilities being patched in 2026?

Because AI has been harnessed to hunt for bugs. Mozilla fixed 423 bugs in its April releases (typically 20–30 a month), 271 of them found with Claude’s help; Chrome patched 1,072 bugs in two releases; Oracle shipped nearly 1,450 patches in a single quarter. According to Epoch AI, the number of serious CVEs from the 21 largest organizations reached ~2,500 in July 2026 — about 5× the record from before the AI-agent era.

How many attacks a week does a company in Poland fend off?

On average, 1,854 attacks a week per organization (Check Point, August 2026, +15% YoY). CERT Polska registered 260,783 incidents in 2025 — more than 700 a day.

Summary

All these numbers tell one story: a race we once measured in weeks, we now measure in minutes — and in places, time has gone negative. Vulnerabilities are appearing faster than ever in history, the exploit outruns the patch, AI has driven the cost of an attack to nearly zero, and at the same time 96% of Polish companies already have an incident behind them. The good news is a perverse one: since only a fraction of vulnerabilities is actually attacked, the winners aren’t the ones with the biggest budget, but the ones who know their own terrain, patch by risk and spot the intruder in minutes, not months. That can be learned — and that’s where every good security plan begins. ✔️

And if you want to check what your company looks like from an attacker’s perspective — you know where to find me.

Data Sources Used in This Post

• cvedetails.com — CVE statistics by year (as of August 19, 2026); Jerry Gamblin — “CVE Data Review” (jerrygamblin.com)
• FIRST — Vulnerability Forecast 2026 (February and June 2026)
• Google Mandiant — “Time-to-Exploit Trends” (2024) and “M-Trends 2026”
• Google Threat Intelligence Group — “2025 Zero-Days in Review” (March 2026)
• VulnCheck — “State of Exploitation” (January and July 2026)
• Verizon — Data Breach Investigations Report 2024–2026
• IBM — X-Force Threat Intelligence Index 2025 and 2026; Sophos — Active Adversary Report 2025 and 2026; Palo Alto Unit 42 — Global Incident Response Report 2025 and 2026
• Coalition — Cyber Threat Index 2025; ENISA — Threat Landscape 2025; Red Canary — Threat Detection Report 2026
• Cloudflare — Application Security Report 2024
• CrowdStrike — Global Threat Report 2026
• Cyentia Institute & FIRST — “A Visual Exploration of Exploitation in the Wild” (2024)
• Zero Day Initiative / Tenable — Patch Tuesday roundups 2024–2026; Apple — security releases (iOS 26.6.1, August 2026)
• Mozilla Hacks — “Behind the scenes: hardening Firefox” (May 2026); Google Security Blog — “Stronger with every update” (July 2026)
• Epoch AI — “Disclosed CVEs: July Reached 5× the Pre-Mythos Record” (July 2026)
• Oracle — Critical Patch Update July 2026; The Register — “Linux kernel team publishes 432 CVEs in two days” (July 2026)
• Zero Day Clock (zerodayclock.com) — exploitation data aggregator (CISA KEV + VulnCheck)
• Veracode — GenAI Code Security Report 2025; Apiiro — AI code analysis (2025)
• Check Point Research — reports 2025–2026; KnowBe4 — Phishing Threat Trends 2026
• Anthropic — threat intelligence reports (August and November 2025); ESET — PromptLock (2025)
• Entrust Identity Fraud Report 2025; Searchlight Cyber — ransomware 2025
• CERT Polska — annual report 2025 and the monthly summary for July 2026; KPMG — Barometr cyberbezpieczeństwa 2026; Xopero — “Cyberbezpieczeństwo — Trendy 2026”; WEF — Global Cybersecurity Outlook 2026