InfoSecBulletin Cybersecurity for mankind
In 2024, 768 vulnerabilities with CVE identifiers were reported as exploited in the wild, a 20% increase from 639 in 2023. VulnCheck called 2024 “a strong year for threat actors exploiting vulnerabilities,” noting that 23.6% of known exploited vulnerabilities (KEVs) were weaponized by or on the day their CVEs were disclosed.
This represents a slight decrease from 2023’s 26.8%, showing that exploitation attempts can occur at any point in a vulnerability’s lifecycle.
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
“During 2024, 1% of the CVEs published were reported publicly as exploited in the wild,” VulnCheck’s Patrick Garrity said. “This number is expected to grow as exploitation is often discovered long after a CVE is published.”
The report comes over two months after the company disclosed that 15 of 60 identified Chinese hacking groups are connected to the exploitation of at least one of the top 15 commonly exploited vulnerabilities in 2023.
“Not surprisingly, the Log4j CVE (CVE-2021-44228) is associated with the most threat actors overall, with 31 named threat actors linked to its exploitation,” Garrity noted late last year, adding the company identified 65,245 hosts potentially vulnerable to the flaw.
Approximately 400,000 internet-accessible systems may be vulnerable to attacks due to 15 security flaws in products from companies like Apache, Atlassian, Barracuda, Citrix, Cisco, Fortinet, Microsoft, Progress, PaperCut, and Zoho.
“Organizations should evaluate their exposure to these technologies, enhance visibility into potential risks, leverage robust threat intelligence, maintain strong patch management practices, and implement mitigating controls, such as minimizing internet-facing exposure of these devices wherever possible,” VulnCheck said.
