grep -rl "patching" ./articles
The claim is everywhere and the argument behind it is good. The number is not a measurement. It comes from a single blog post in May 2026 describing a local experiment on React, and the industry statistics stacked around it come from different vendors counting different things.
CVE-2026-45659 was patched in May, flagged as exploited on 1 July with a three-day federal deadline, and marked as used in ransomware on 11 August. Of 8,500 SharePoint servers exposed online, 200-plus remain vulnerable.
The annotation feature opens a direct channel between viewers and the person sharing. A Security's 'Zoomsday' chain starts with a missing bound check in the text annotator and ends in remote code execution.
QUIRSO traced exploitation of CVE-2026-59310 across 47 countries, with victims first contacting attacker infrastructure on 3 August. The persistence mechanism is a cron job running an open-source reverse SSH tool.
Microsoft attributes StormEncryptor, a new C++ locker, to the China-linked group. Initial access was likely CVE-2026-18577 in N-able N-central, which is itself a bypass of the earlier fix. CISA has both flagged as exploited.
Unauthenticated SQL injection through the password-reset endpoint, every release from 1.58 onward affected, and confirmed victims already naming what was taken. It is tracked as a GitHub advisory, which means NVD-driven scanners will not see it.