Reported vulnerabilities grew 36% in Q2, but almost none of it changed how attackers got in.
While more than 20,700 new vulnerabilities were disclosed, confirmed exploitation in the wild grew by just 10%. The population of vulnerabilities disclosed grew by a third, but the methods attackers are using to gain initial access barely moved.
That gap is straining the systems built to track vulnerabilities. In response:
- NIST has stopped enriching every CVE it receives.
- HackerOne paused new submissions to its Internet Bug Bounty program.
- Pwn2Own rejected contestant applications for the first time ever.
- Cisco rebuilt its entire disclosure model, including bundling multiple flaws under a single CVE, a departure from how CVE IDs are supposed to work.
Even Anthropic's Mythos model got swept in, briefly restricted from foreign access by a US export order in June before the restriction was lifted later that same month.
Filtering that volume down to what matters is the point of this report. Beazley Security Labs continually monitors the vulnerability landscape to identify the threats most likely to result in real world compromise, supporting our Exposure Management platform. Of the roughly 5,600 high-risk CVEs disclosed this quarter, Beazley Security Labs issued 21 advisories, up 40% from Q1.
TeamPCP's continued run through the developer supply chain turned noise into impact. In May, the group hijacked TanStack's CI/CD pipeline and pushed malicious packages to NPM. The compromise lasted only a few hours but produced more than 500 million infected downloads before it was caught. TeamPCP also breached GitHub's own internal systems, exposing 3,800 repositories belonging to organizations that had nothing to do with the original compromise. TeamPCP further amplified the threat by publishing the worm's source code and build instructions on BreachForums and launching a cash-prize competition challenging others to cause the most damage with it.
While TeamPCP's own activity slowed by July, supply chain risk in Q2 wasn't limited to one actor. In June, competitive intelligence platform Klue was compromised, once again exposing client Salesforce instances, this time at large enterprises, with some cybersecurity firms among the victims.
Threat actors kept experimenting with AI beyond the supply chain, with uneven results. Sysdig documented JADEPUFFER, which it assessed as the first ransomware campaign run end to end by a large language model. At the other extreme, researchers analyzing Iranian-linked ICS malware found code riddled with logic errors, likely hallucinated by the model that wrote it.
Once again, law enforcement had a real (but temporary) effect on the infostealer market. Operation ENDGAME actions against First VPN, SocGholish, Amadey, and StealC produced a measurable drop in activity starting in May, though no arrests were announced. The StealC operator was back with a new build within four days and put the old source code up for sale at $60,000. LummaStealer, hit hard by ENDGAME last year, is attempting a quiet return under the name Remus.
None of that changed how ransomware gets in: 67% of intrusions started with compromised credentials against exposed VPN and RDP. Malware via SEO-poisoned installers accounted for another 14%.
What did change is what happens after. A growing share of affiliates skipped encryption entirely this quarter, opting for pure data theft and extortion. We saw the pattern emerge from Inc Ransomware, Brain Cipher, and Pear affiliates.
To bypass MFA in BEC cases, attackers increasingly abused Microsoft's device code sign-in flow, a mechanism built for devices like smart TVs where a second device completes the login. The attacker generates a device code and lures the victim into entering it on a real Microsoft sign-in page. Because the login and MFA are genuine, nothing looks wrong to the victim, and the attacker collects the resulting session token.
The front door has not changed. The noise around it has.
