Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Enterprise security has a speed problem. Attackers are getting faster at finding and exploiting vulnerabilities, while many organizations still rely on ticket-based remediation, approvals, and scheduled maintenance windows. AI threatens to widen that gap considerably, exposing one of vulnerability management’s largest unchanged challenges: getting the right systems to fix the right problems before attackers exploit them.

Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One, Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.

CYJAX profiles APT41’s BlackX UEFI bootkit campaign against Central Asian diplomatic agencies and the UAC-0099 and Sandworm compromise of a Ukrainian grain logistics company, with key takeaways and defensive guidance. APT41 is using a UEFI bootkit against Central Asian diplomatic agencies, while UAC-0099 appears to have handed a backdoor to Sandworm in Ukraine. CYJAX breaks down both threats and what defenders should do next.

In May 2026, Counter Threat Unit (CTU) researchers published a report on an AI-assisted post-exploitation framework that tested the capabilities of multiple vendors’ endpoint detection and response (EDR) solutions, including the Sophos agent. Following a testing phase, Sophos analysts observed the same infrastructure hosting Cobalt Strike in support of Aur0ra ransomware (also known as Aurora ransomware) operations.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) arrived with predictions of a Log4Shell-scale mass exploitation event. Panic was visible, many rushed to update or even disconnect systems from the Internet until a patch was applied. PHP runs a large share of the web and the vulnerable ranges were reported to cover every branch from 5.4 to 8.5, which are essentially the majority of versions we can see deployed in the internet installed base.

We’re excited to share that Detectify is one of the vendors featured in KuppingerCole’s Analysts 2026 Leadership Compass on Attack Surface Management. Attack surfaces grow every time a team ships code, opens a port, or points a DNS record to a new service. Keeping track of what’s exposed is hard enough, and knowing which of those exposures an attacker can actually use is harder still.

For the first time in this research series, the numbers moved. Since we began tracking AI-generated code security, the average pass rate has barely budged from 55–56%. Four snapshots, over 100 models, massive advances in capability… and the average stayed flat. Last quarter, we noted that the ceiling had actually dropped, from 72% (GPT-5 Mini, October 2025) to 68% (GPT-5.5, Summer 2026). The headline was “the ceiling won’t break.”

GitHub’s Octoverse 2026 counted 34.3 billion commits, and over 40% of pull requests now start with an AI agent. Read to learn what the State of the Octoverse 2026 Report reveals about AI, citizen developers, and our new security reality.

Why a Five Eyes follow-the-sun Security Operations Centre delivers better outcomes than a local SOC with a pager, and how to tell which one you are really buying.