High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

What it is

Rapid7's Q3 2026 threat landscape report, as covered by SecurityWeek. The summary has the headline figures. This note adds the details that bear on patch prioritisation and detection.

Findings the summary omits

• Exploit speed: 79% of the high-severity flaws exploited in Q3 are what Rapid7 calls "holy grail" vulnerabilities: remotely exploitable, with no credentials and no local user involvement needed. The three-day average and 71% within seven days apply to this set.
• Ransomware targeting: the most hit sectors were business services, manufacturing and healthcare. After the US (60%), the top countries were Germany (7%), Italy (5%) and Canada (5%). The next groups after The Gentlemen (342) and Qilin (339) were INC Ransom (99), DeadLock (98) and Krybit (95).
• Government victims: ransomware victims in the government sector rose 15% on the previous quarter. The US share of those victims grew from 33% in Q2 to 45% in Q3.
• Access brokers: 41 of 63 underground posts advertised RDP or network access. Fourteen involved selling, sharing or discussing exploits and zero-days. Listings ranged from single accounts (bank logins bundled with identity data for at least three major US banks) to full enterprise footholds. Rapid7 treats these posts as an early-warning source.

AI use

Douglas McKee, director of vulnerability intelligence at Rapid7, says AI was an operational component in 8% of tracked incidents and that AI exploitation "didn't show up in our data this quarter". The report says humans chose the target and the reason in every documented case. What is being automated is the "tactical middle": technique selection, target triage and recovery from a failed step. McKee separates AI finding flaws, which is real and accelerating, from AI exploiting them.

Attackers evade provider safeguards by splitting objectives across multiple sessions, because single-session malicious requests are often blocked.

What to do

• Treat remote, unauthenticated flaws as a days-scale patching problem, not a monthly one.
• Rapid7 advises monitoring AI API usage from unexpected hosts and processes as a telemetry source.
• Watch underground access-broker and exploit listings as an early signal.

DPRK toolkit 'ted'

Rapid7 describes it as previously undocumented. It is a Linux toolkit that includes a trojanized HAProxy build, an SSH keylogger and a curl-based RAT. It has been used against South Korean organisations since early 2025. The page gives no indicators of compromise or detection logic.

Caveats

The page is a news summary and gives no methodology, CVE identifiers or sample sizes behind the 8% AI figure. Rapid7's report predicts fully automated AI-assisted attacks within the next few years.