The threat landscape continues to evolve at an unprecedented pace. The Rapid7 2026 Global Threat Landscape Report analyzes global attack patterns, emerging vulnerabilities, and shifting adversary tactics to provide security teams with actionable intelligence for the year ahead.

Group Policy Objects (GPOs) are a common target for ransomware operators seeking to establish persistence and lateral movement across enterprise networks. This case study examines how predictive shielding technology in Microsoft Defender identified and blocked a GPO-based ransomware attack before the malware reached execution stage.

Threat actors tracked as UAT-10608 are conducting a large-scale automated credential harvesting operation against web applications. The campaign leverages NEXUS Listener, a tool designed to intercept and exfiltrate user credentials from web-based systems. Analysis reveals the operation targets multiple application types and industries, exploiting CVE-2025-55182 to establish persistence.

Fortinet has confirmed that CVE-2026-21643 is being actively exploited in the wild, marking another significant vulnerability in the company's security portfolio. This flaw poses direct risk to organizations relying on Fortinet solutions for network protection and threat defense.

Executive leadership faces unprecedented security challenges as browser technologies and artificial intelligence become central to enterprise operations.

Security researchers have identified active exploitation of CVE-2025-53521, a critical remote code execution vulnerability affecting F5 BIG-IP APM systems. The Brickstorm threat actor is leveraging this vulnerability to target financial services, government, and public sector organizations.