Q2 2026 Attack Techniques Trend Report

Q2 2026 saw a marked rise in active exploitation targeting public-facing applications, identity infrastructure, and AI stacks: KEV listings increased ~27%, ransomware-associated listings doubled proportionally, and multiple zero-days and AI RCE/vector vulnerabilities (including CVE-2026-42824, CVE-2026-26030, CVE-2026-25592, CVE-2026-42271) were identified as exploited. The report highlights common attacker techniques (T1190, device-code phishing, AiTM, telemetry blocking), malicious AI skill supply-chain activity, and recommends shifting defenses to behavior-based detection, identity protections (short-lived tokens, MFA, ITDR), and stronger AI input/output controls and supply-chain verification.