Radware finds web DDoS attacks doubled as the patch window turns negative

Radware reports that web distributed denial-of-service (DDoS) attacks doubled in the first six months of 2026, up 166% from 2025. Mitigations against these attacks rose 110.6% compared to the same period last year, and 36.3% compared to the second half of 2025. The majority of mitigated packets were direct-path volumetric floods, with stateless UDP floods accounting for 73% of them.

The technology sector experienced the highest number of network DDoS attacks, with an average of 509 attacks per customer daily. The Middle East was the hardest hit region, with customers experiencing 520 attacks daily. The report found that attackers are exploiting zero-day vulnerabilities at an alarming rate, with a mean time to exploit of negative eight hours.

This is a significant decrease from 21.5 days in 2025 and 53 days in 2024. Additionally, AI agents and autonomous workflows are being deployed without proper visibility, creating a larger attack surface. The report suggests that organizations are moving away from reflection and amplification methods, with direct-path volumetric floods being the dominant technique.