Cisco Talos Warns of Exploding CVEs and New Rust RAT Hijacking Browsers
Cisco Talos reports a 49% year-over-year increase in CVEs in Q2 2026, highlighting the growing challenge of patching, and details a new Rust-based RAT called msaRAT that evades detection by hijacking browser C2 channels.
Cisco Talos's latest Threat Source newsletter paints a stark picture of the escalating vulnerability landscape, revealing a significant 49% year-over-year increase in disclosed CVEs during the second quarter of 2026. By the end of June, the security research firm was tracking close to 200 new CVEs daily, a relentless surge that underscores the growing difficulty for organizations to keep pace with the sheer volume of discovered flaws.
The analysis also highlights a persistent challenge: the aging nature of actively exploited vulnerabilities. Despite the rapid influx of new CVEs, a striking 46% of vulnerabilities currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog date back to 2025 or earlier. This statistic emphasizes that even with standard enterprise patch cycles of 30-90 days, the speed of vulnerability discovery, particularly by automated and AI-driven methods, is outpacing human-driven patching efforts.
To combat this overwhelming influx, Cisco Talos reiterates the importance of prioritizing patching efforts using tools like the Exploit Prediction Scoring System (EPSS). The report notes that while thousands of CVEs might have high CVSS scores, a vast majority have a low probability of exploitation according to EPSS. Conversely, a small subset of high-CVSS, high-EPSS vulnerabilities, many already on the KEV list, represent the most critical targets for immediate remediation.
Beyond the broader vulnerability trends, Cisco Talos has identified a new and sophisticated threat: "msaRAT," a remote access trojan developed in Rust by the Chaos ransomware group. This malware employs a novel evasion technique by hijacking legitimate browser command-and-control (C2) channels through the Chrome DevTools Protocol (CDP). This method allows the RAT to establish covert communication without directly interacting with the network, making it significantly harder to detect with traditional security tools.
The infection vector for msaRAT typically begins with a deceptive MSI file disguised as a Windows update. Once executed, the payload is loaded directly into memory, bypassing traditional file-based detection mechanisms. This stealthy approach facilitates the subsequent deployment of the Chaos group's double-extortion ransomware, aiming to exfiltrate data and encrypt systems for maximum impact.
The use of Rust and the Tokio asynchronous runtime in msaRAT's development contributes to its efficiency and ability to perform tasks in parallel, accelerating the attacker's operational tempo. By leveraging the CDP, the malware effectively blends its C2 traffic with legitimate browser activity, posing a significant challenge for network security monitoring.
Cisco Talos advises defenders to remain vigilant for unusual curl commands, especially those downloading MSI files to the ProgramData directory or exhibiting plain HTTP traffic on port 443. Scrutinizing unexpected MSI files masquerading as system updates and monitoring for unauthorized manipulation of Chrome or Edge browsers are crucial steps. Implementing behavioral monitoring to detect CDP abuse and unauthorized WebRTC connections is also recommended to identify and mitigate msaRAT infections.
This report from Cisco Talos serves as a critical reminder of the evolving threat landscape, where the sheer volume of vulnerabilities, the persistence of older flaws, and the ingenuity of new malware like msaRAT demand a more intelligent and prioritized approach to cybersecurity defense.