World threat landscape
What attackers are doing worldwide right now: vulnerabilities being exploited, ransomware groups' activity, live botnet command-and-control, and data breaches. A daily snapshot from public sources — hover any chart for exact values.
Snapshot taken Thu, 29 Oct 2026 13:05:32 GMT
Exploited vulnerabilities (CISA KEV)
1.8k
34 added in the last 30 days
Ransomware victims posted, recent
100
from leak-site monitoring
Botnet C2 servers tracked
5
1 online now
Breached accounts on record
17.8B
across 1048 breaches
New exploited vulnerabilities per month
Hover or tap a month for its value
Most-exploited vendors
- Microsoft39042%
- Cisco10111%
- Apple9510%
- Adobe839%
- Google768%
- Oracle465%
- Apache414%
- Ivanti364%
- Linux323%
- Fortinet323%
Ransomware posts per day
Hover or tap a day for its value
Most active ransomware groups
- qilin1925%
- Whitearmor1013%
- Booba Project1013%
- everest811%
- play79%
- SilentRansomGroup68%
- payload57%
- aurora45%
- N0n34%
- akira34%
Ransomware victims by country
- US3958%
- DE812%
- IT46%
- GB46%
- MX34%
- MY34%
- SG23%
- FR23%
- CA23%
Ransomware victims by sector
- Professional Services1516%
- Healthcare1213%
- Not Found1112%
- Manufacturing1112%
- Technology1011%
- Retail & E-Commerce89%
- Energy & Utilities78%
- Financial Services67%
- Education67%
- Other67%
Botnet C2 by malware family
- QakBot480%
- Emotet120%
Botnet C2 by hosting country
- US360%
- GB120%
- JP120%
Latest vulnerabilities added to KEV
| CVE | Vendor · product | Vulnerability | Added | |
|---|---|---|---|---|
| CVE-2026-41709 | Broadcom · VMware ESX | Broadcom VMWare ESX Insufficient Logging Vulnerability | 2026-10-28 | |
| CVE-2026-46300 | Linux · Kernel | Linux Kernel Missing Initialization of a Variable Vulnerability | 2026-10-28 | |
| CVE-2026-48356 | Adobe · Commerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-10-27 | |
| CVE-2026-111497 | Google · Brotli | Google Brotli Unchecked Return Value Vulnerability | 2026-10-27 | |
| CVE-2026-109618 | PHP Group · PHP | PHP Memory Corruption Vulnerability | 2026-10-26 | |
| CVE-2026-109619 | PHP Group · PHP | PHP Stale Internal Request-State Vulnerability | 2026-10-26 | |
| CVE-2026-114625 | Arista · VeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability | 2026-10-23 | |
| CVE-2026-110447 | Collabora · Collabora Online – Built-in CODE Server | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | 2026-10-23 | |
| CVE-2026-106931 | EG Secure Solutions · SiteGuard Server Edition | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | 2026-10-20 | |
| CVE-2026-96656 | Plex · Media Server | Plex Media Server External Control of File Name or Path Vulnerability | 2026-10-20 | |
| CVE-2026-96655 | Plex · Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-10-20 | |
| CVE-2026-96654 | Plex · Media Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 2026-10-20 |
Latest data breaches
| Breach | Accounts | Breached | |
|---|---|---|---|
| AfD | 345,439 | 2026-09-09 | verified |
| Assurance Retraite | 70,372 | 2024-09-01 | verified |
| Gîtes de France | 117,574 | 2026-05-16 | verified |
| Crunchbase | 559,908 | 2026-01-22 | verified |
| Sharecare | 318,185 | 2026-08-12 | verified |
| Neogen | 435,963 | 2026-08-29 | verified |
| CyrusOne | 373,460 | 2026-08-05 | verified |
| Double Counter | 274,922 | 2026-10-04 | verified |
| Angel One | 6,765,054 | 2023-04-01 | verified |
| Medela | 423,947 | 2026-09-07 | verified |
What breaches expose
- Email addresses1,04123%
- Passwords67415%
- Names56613%
- Usernames48511%
- IP addresses3879%
- Phone numbers3839%
- Physical addresses3097%
- Dates of birth2886%
- Genders1984%
- Geographic locations1523%
Sources: CISA Known Exploited Vulnerabilities, ransomware.live, abuse.ch Feodo Tracker, Have I Been Pwned. Refreshed daily on GitHub’s runners. Victim names and raw indicators are deliberately not shown — this page is for seeing the landscape, not for repeating what criminals publish.