Image: Cisco Talos
More than 70,000 vulnerabilities were recorded by the end of September 2026, but the number known to be actively exploited rose much more slowly. For PC users and organizations, the practical priority remains installing overdue security updates, especially on older systems and archive tools.
Discovery is rising faster than exploitation
Cisco Talos reports that CVE volume increased 105% year over year, while the KEV catalog grew 37%. The figures show a sharp rise in disclosed flaws, but not an equal rise in vulnerabilities with confirmed exploitation.Older flaws remain a significant problem: vulnerabilities from 2025 or earlier make up 33% of KEV entries. This points to a continuing patch gap rather than attacks being limited to newly discovered zero-days.
Espionage campaign targets government and infrastructure
Cisco Talos and Recorded Future’s Insikt Group also disclosed activity by UAT-6275 against government and critical-infrastructure organizations across the Commonwealth of Independent States. Researchers identified four infection chains using macro-enabled documents, scripts hosted on GitHub and a WinRAR vulnerability.The attackers deliver custom reverse shells, tools that let an intruder remotely run commands on an infected device. Recovered tools also suggest the group may be preparing to target Linux computers and internet-facing appliances.
What users and defenders should do
- Install available updates for WinRAR and other archive utilities rather than postponing them.
- Treat unexpected macro-enabled documents cautiously, particularly in organizations operating in the targeted regions and sectors.
- Investigate unexpected PowerShell activity and downloads from public services such as GitHub.
- Check for unfamiliar scheduled tasks or unauthorized additions to the Windows Startup folder, both of which can keep malware running after a restart.
