[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXGoJw_BU1ZOlnqH03tdz9X8S9nXYiJGa6z694PbkHUM":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"acd4f8b6-d8df-4173-b4a2-614d2ab9ba5e","High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7","high-severity-flaws-exploited-in-three-days-as-ransomware-dominates-q3-rapid7-f7e7db","Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek.","Rapid7's Q3 analysis reveals high-severity vulnerabilities are exploited within an average of three days, with 71% targeted in the first week. Ransomware remains the primary global threat, with the US being the most targeted nation and business services, manufacturing, and healthcare the most affected sectors. While AI is present in 8% of tracked incidents, it's largely used manually, with humans still directing attack strategies.","Rapid7 Q3 report: High-severity flaws exploited in 3 days; ransomware dominates; AI use in attacks is low.","https:\u002F\u002Fwww.securityweek.com\u002Fhigh-severity-flaws-exploited-in-three-days-as-ransomware-dominates-q3-rapid7\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F11\u002FThreat-Intelligence-sharing.jpg","2026-10-21T14:45:00+00:00","2026-10-21T16:00:06.412876+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Rapid7","vendor",{"name":21,"type":22},"The Gentlemen","threat_actor",{"name":24,"type":22},"Qilin",{"name":26,"type":22},"INC Ransom",{"name":28,"type":22},"DeadLock",{"name":30,"type":22},"Krybit","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55],{"type":51,"value":56,"context":57},"ted","Previously undocumented Linux backdoor toolkit used by DPRK against South Korean organizations.",[18],{"controls":60,"vendors":146},[61,89,118],{"slug":62,"name":63,"problem":64,"products":65},"patch-management","Automated patch management","Known holes get closed in days, not months.",[66,73,81],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":62,"product_name":70,"url":71,"description":72},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":35,"name":119,"problem":120,"products":121},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[147],{"slug":148,"name":18,"logo_path":149,"roles":150},"rapid7","\u002Fvendor-logos\u002Frapid7.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":164},"high-severity-vulnerabilities-exploited-within-3-days-as-ransomware-surges","High-Severity Vulnerabilities Exploited Within 3 Days as Ransomware Surges","Rapid7's Q3 findings reveal that threat actors are exploiting high-severity vulnerabilities within an average of just three days of disclosure, with 71% targeted within the first week — leaving virtually no margin for slow or manual patching processes. Ransomware operators are the primary beneficiaries of this speed advantage, hitting US-based organizations in business services, manufacturing, and healthcare hardest. This underscores a fundamental gap between the pace of vulnerability disclosure and organizations' ability to assess, prioritize, and remediate exposures at scale. When patch cycles run on weekly or monthly schedules, attackers operating on a 72-hour timeline will almost always win. Organizations must treat critical vulnerability disclosure as an emergency event requiring immediate operational response, not a routine IT task.",[157,158,159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"CIS Control 17: Incident Response Management":167,"OWASP A06:2021 Vulnerable and Outdated Components":168,"CIS Control 7: Continuous Vulnerability Management":169,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":170,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":171},"NIS2 requires essential and important entities to implement incident handling and vulnerability disclosure practices with appropriate urgency — the healthcare and critical infrastructure sectors hit hardest in Q3 fall squarely under this obligation.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined time periods — explicit remediation deadlines aligned to threat intelligence would have closed the exploitation window.","A tested incident response plan with predefined ransomware playbooks enables organizations to contain and recover faster, reducing the dwell time and business impact that make these attacks so damaging when initial prevention fails.","The ransomware campaigns described rely on unpatched, vulnerable components as their primary entry point — exactly the risk A06 addresses by demanding continuous tracking and rapid updating of all software dependencies and system components.","A formal continuous vulnerability management program with defined SLA windows (e.g., 24–48 hours for critical flaws) would have matched or beaten the attackers' average three-day exploitation timeline.","A.8.8 mandates timely identification and remediation of technical vulnerabilities; had organizations followed this control with urgency proportional to severity, the three-day exploitation window would have been unachievable for most attackers.","Once vulnerabilities are exploited, attackers escalate privileges and move laterally; strong access controls prescribed here limit the blast radius ransomware can achieve even when initial exploitation succeeds."]