Active Cyber Exploits Rise in First Half of 2026
Report data shows a 34% increase in exploited software vulnerabilities compared to the same period in 2025.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust that your payment information is secure when shopping on standard online retail websites?
Recorded Future identified 215 actively exploited vulnerabilities during the first half of 2026. This reflects a 34% increase in activity over the same period in 2025.
Why it matters
The rise in exploitation highlights a persistent risk environment where attackers frequently leverage trusted tools to mask malicious behavior. Security teams face an increasing alert volume as threat actors continue to target payment pages.
Recorded Future tracked 215 actively exploited vulnerabilities in the first half of 2026, marking a 34% increase over the previous year. On average, exploitation occurs 564 days after a vulnerability is initially disclosed.
The players
Recorded Future
Recorded Future is a global cybersecurity intelligence company that specializes in collecting and analyzing data to identify threats.
The details
Threat actors are increasingly using legitimate developer tools, remote access utilities, and third-party services like Google Tag Manager to blend in with normal traffic. Campaigns such as those targeting WooCommerce have successfully replaced legitimate payment forms with counterfeit iframes to steal customer card data.
Timeline
First half of 2025: Baseline period for recorded exploited vulnerability counts.
First half of 2026: Period during which 215 active vulnerabilities were identified.
The Tech Race
The findings reflect a broader industry shift where cybercriminals move away from custom malware toward exploiting legitimate infrastructure to evade detection. This data updates established figures from the Recorded Future vulnerability intelligence program.
Users should remain vigilant during online checkout processes, as attackers are actively mimicking legitimate payment forms to harvest financial data. Security teams must account for the extended window of risk, as many exploited vulnerabilities remain unpatched for over 500 days.
The takeaway
Organizations should prioritize patching long-standing vulnerabilities to reduce the window of exposure that attackers rely on. Implementing robust monitoring for third-party scripts can help detect malicious modifications before data exfiltration occurs.
Further reading
For more context on digital security risks, visit our dedicated Cybersecurity section.
Source note: This article includes information reported by SecurityBrief Asia.
Live Poll
Do you trust that your payment information is secure when shopping on standard online retail websites?
