Microsoft 2026 Digital Defense Report: attackers gain the upper hand with AI

Microsoft's "2026 Digital Defense Report" covers July 2025 to June 2026 and notes that attackers are gaining AI benefits ahead of defenders. The median time from in-the-wild discovery of a vulnerability to weaponization has dropped to under 24 hours, with 2026 CVE counts projected to reach a record 72,000, while remediation speed cannot keep up; Microsoft expects known unpatched vulnerabilities to accumulate for years. Phishing's share of intrusions investigated by Microsoft's incident response team rose from 7% a year ago to 23%, and exploitation of vulnerabilities in public-facing applications rose from 15% to 24%. The report also mentions that the s1ngularity malware, spread through a poisoned Nx npm package, looks for and runs Claude Code, Gemini CLI, or Amazon Q CLI on infected machines to hunt for secrets, leaking about 2,000 secrets and about 20,000 files involving 225 victims; the PromptLock ransomware prototype carries only a prompt and, at runtime, fetches Lua scripts from an open-weight model on attacker infrastructure.