Follow the cyber attacks of November 2026 as they happen. This live HACKMAGEDDON dashboard is updated every day with newly vetted incidents. It shows the leading motivations, attack vectors, targeted sectors and countries on an interactive map, plus a filterable, searchable timeline linking to each source.

AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a horizontal timeline, with charts showing which AI companies and agents are involved, the techniques used and how they got in. It updates automatically as new events are added.

September 2026 saw 181 confirmed cyber incidents, roughly one every four hours. Cybercrime drove 73.8% of attacks and espionage 19.1%. Malware led the techniques with 53 campaigns, ahead of Remote Code Execution with 32. More than a quarter of breaches started with an exploited public-facing application, and the United States was the most targeted country at 23.0%. This infographic summarizes the month's key numbers from the HACKMAGEDDON timeline.

A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.

A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.

A one-page visual summary of the 16–31 August 2026 cyber attacks timeline: 110 incidents broken down by motivation, attack technique, initial access vector, targeted sector, and country — Cyber Crime and Malware led the period, with Information & Communication the hardest-hit sector.

The second half of August 2026 brought 110 confirmed cyber incidents, with Cyber Crime once again the dominant motivation at 78% of attacks. Malware remained the weapon of choice, exploitation of public-facing applications (T1190) continued to lead initial access, and Information & Communication emerged as the hardest-hit sector. This timeline breaks down the period by motivation, attack technique, initial access vector, target sector, and country.

Cyber crime dominated the first half of August 2026, driving 108 confirmed incidents in just fifteen days. Malware remained the attacker's weapon of choice, a third of breaches traced back to an exploited public-facing application, and Public Administration emerged as the hardest-hit sector.

103 confirmed cyber incidents reported between 15 and 31 July 2026 — including attacker motivations, top techniques, initial access vectors, hardest-hit sectors, and targeted countries, all in one interactive HACKMAGEDDON timeline.

85 confirmed cyber incidents shaped the first half of July 2026, with cyber crime accounting for more than three-quarters of all attacks. Malware — spanning RATs, infostealers, spyware, and backdoors — was the dominant weapon, involved in 37 of 85 incidents (43.5%). Information & Communication infrastructure emerged as the hardest-hit sector, targeted in nearly 1 in 3 sector mentions.

Between 16–30 June 2026, 96 confirmed cyber incidents shaped the threat landscape — Cyber Crime drove roughly 8 in 10 attacks, malware remained the top weapon, and Information & Communication infrastructure took the hardest hit.

Security vendors were prime targets in the first half of 2026, with 55 confirmed exploitation incidents involving 66 CVEs across the main vendors. Explore the full interactive timeline and charts.

The threat landscape in May H2 2026 was driven by cyber crime and dominated by malware. Exploitation of public-facing app vulnerabilities continued to play an important role, similarly to supply chain attacks.

The threat landscape during May H1 was dominated by cyber crime and characterized by malware attacks, while the exploitation of public-facing applications led the initial access.

In the second timeline of April 2026 I collected 108 events, corresponding to an average of 7.2 events per day, a number that confirms a growing trend, driven by the increasing number of supply chain attacks, compared to the previous timeline, where I collected 94 events (6.27 events/day).

The first timeline of April 2026 brings an evolution in terms of methodology: from now on I will map the initial access techniques with the MITRE ATT&CK model. I also decided to merge the categories of Finance and Fintech in the sectors chart. From an event perspective, the first half of April 2026 confirmed a sustained trend...

The second half of March 2026 has been very active from an infosec standpoint, with 124 events and a threat landscape dominated by malware. As always, cyber crime led the motivations chart with 65%, slightly up from the previous timeline.

In the first half of March 2026 I collected 95 events (6.34 events/day) with a threat landscape dominated by malware once ahead of account takeovers and ransomware.

In the second half of February 2026 I collected 80 events with a threat landscape dominated by malware with 42%, ahead of account takeovers and ransomware.

In the first half of February 2026 I collected 96 events (6.4 events/day) with a threat landscape dominated by malware with 33%, (it was 38% in the second half of last month, once again ahead of ransomware (up to 20% from 14%), and account takeovers, down to 8% from 14%.