.webp)
Recorded Future's Insikt Group has published research showing 215 actively exploited vulnerabilities in the first half of 2026, up 34% on the same period a year earlier.
The findings also pointed to a long tail in exploitation activity, with exploitation reported or detected an average of 564 days after disclosure. The data suggests attackers continued to use older weaknesses while also moving quickly against newly disclosed flaws.
Supply chain compromises emerged as a significant theme. Analysts said threat actors increasingly abused trusted access paths, software distribution channels and intermediary platforms to reach downstream victims at scale.
Evidence from the first half of the year included compromises affecting systems that hold customer, patient, financial and operational data. The sectors and environments cited included medical sales platforms, digital health services, insurance operations, financial institutions and blockchain governance controls.
The report described a shift towards attacks that exploit trust relationships rather than requiring the direct compromise of every target. In these cases, compromised credentials, administrative privileges, multi-signature authority and supplier-managed systems gave attackers routes into high-value data or assets.
Developer tools
Abuse of package managers and developer tooling featured heavily in the supply chain activity reviewed. Researchers said threat actors used compromised maintainer accounts, package lifecycle scripts and developer platforms to steal credentials, spread malicious packages and maintain access across software ecosystems.
One example involved npm packages linked to SAP Cloud Application Programming Model and Cloud MTA tooling. The research said compromised packages, including mbt and several @cap-js/* packages, introduced malicious preinstall behaviour during npm install, downloading a Bun runtime and running an obfuscated payload in developer and CI/CD environments.
The payload was reported to harvest GitHub, npm, cloud, Kubernetes, Docker, messaging, cryptocurrency wallet, browser, SSH and developer tooling credentials. It also probed cloud metadata services, extracted CI secrets from runner memory, created GitHub repositories for encrypted exfiltration and published additional compromised npm packages.
The research cited Socket's assessment that the activity was linked with medium confidence to TeamPCP and related Shai-Hulud-style campaigns. It said the incident showed how routine dependency installation can become a route for credential theft, propagation and persistence.
AI-enabled developer tools also featured in the report's assessment of the software supply chain. The analysis said these tools are becoming part of the attack surface because of their access and automation privileges within development environments.
Examples included reports that Shai-Hulud altered Claude Code configuration files to add session hooks that re-executed malware when the tool started, and a separate case in which TeamPCP was said to have compromised LiteLLM, an AI gateway used to connect applications with multiple large language model providers. In that case, the attackers were reported to have harvested API keys, cloud credentials, SSH keys, Kubernetes secrets and other developer credentials before moving into downstream cloud and container environments.
The report argued that the risk around AI-enabled development tools lies not only in the underlying models but also in their connections to repositories, CI/CD systems, cloud platforms, package ecosystems and other privileged services. Once a trusted component is compromised, those integrations can widen an attacker's access.
Alert burden
Dan Elliott, Field CISO, APJ, Recorded Future, said the volume of security alerts remained a practical problem for defenders.
"Alert volume will continue to be a challenge for security teams. The solution will be in knowing which vulnerabilities threat actors are actually using. Being able to identify and triage them at AI speed is what will separate teams that get ahead of exploitation from the ones reading about it after the fact," Elliott said.
Beyond supply chain issues, the research found attackers continued to prefer legitimate tools, trusted platforms and routine workflows already present in enterprise and consumer environments. Exposed software, developer tools, remote access utilities, payment workflows and third-party services were used to gain access, steal credentials, move laterally and monetise intrusions while blending into normal activity.
That pattern raises the risk that malicious activity progresses through approved tools and services before defenders identify it. The report said this increases the importance of exposure management, identity and credential controls, behavioural detection, developer-environment security, backup resilience, mobile fraud monitoring and third-party oversight.
On mitigation, the research urged organisations to maintain regular inventories of internet-facing hosts, including remote access appliances, edge devices and third-party software. It also recommended prioritising monitoring of gateway products such as SSL-VPNs, firewalls and virtualisation underlays, which were frequently exploited during the period studied.
The report also called for rapid patch deployment workflows for vulnerabilities with public proof-of-concept exploits or active exploitation. Where immediate patching is not possible, it recommended measures including web application firewall rules, intrusion prevention signatures, access restrictions and network segmentation.
Other defensive steps included enforcing multi-factor authentication on administrative interfaces, disabling unused legacy services, tuning endpoint detection and SIEM tools to correlate suspicious sequences of activity, restricting risky script execution and auditing credentials across npm, GitHub, CI/CD, cloud, container, SSH, messaging and developer tooling environments.
It also advised organisations to monitor for unauthorised repository creation or dependency changes, inventory and restrict remote monitoring and management tools, and watch for signs of suspicious command execution, scheduled task creation, attempts to disable endpoint security and unusual data staging or exfiltration.
The research also noted that AI-enabled cyberattacks became more visible in the first half of 2026 but remained largely additive to established intrusion methods.