New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles

Rapid7's Q2 2026 Quarterly Threat Landscape Report reveals that vulnerability disclosure volume has doubled year-over-year to 8,539 high- and critical-severity CVEs, while attackers increasingly leverage AI-assisted automation to exploit vulnerabilities faster than traditional patch cycles can address them. The report identifies that 62% of exploited vulnerabilities require no user interaction, with missing-authentication flaws surging 247% year-over-year, and highlights persistent nation-state activity from Iranian, North Korean, and Russian clusters alongside continued ransomware campaigns led by Qilin. Organizations can no longer rely on patching volume alone; success requires understanding which exposures are actually reachable and prioritizing risk reduction based on exploitability rather than severity scores.