In June, FIRST forecast that about 66,000 CVEs would be published in all of 2026. We passed that number in the middle of September.
This is just the beginning.
Security loves to sensationalize. This isn't that. These are public numbers, and last week showed what they look like in the real world.
We pulled every count straight from the NVD API on October 25.
FIRST's forecast came out in June (Help Net Security). The year passed it with three and a half months still to go.
Three things changed at once, and none of them is going away.
First, finding bugs got cheap. On April 7, Anthropic announced Project Glasswing and Claude Mythos Preview. Within five weeks, VulnCheck was tracking steep year-to-date jumps from the biggest CVE numbering authorities: Chrome up 563%, GitHub up 476% and Apache up 170%. Glasswing partners have reported more than 10,000 high or critical vulnerabilities, including 271 in Firefox alone (Resilient Cyber). Mythos-class models became commercially available in June, and far smaller models are catching up. One model about 600 times cheaper found the same flagship FreeBSD exploit.
Second, we are looking where nobody looked before. Numbering authorities are clearing backlogs, GitHub Security Advisories keep growing and the software ecosystem keeps getting bigger. As an APNIC analysis of FIRST's data put it, "we are looking in places we largely ignored before."
Third, code is being written faster than ever. In a Black Duck survey of 831 engineers, 97% were already using AI coding assistants (Infosecurity Magazine). More code, written faster, means more bugs to find.
Some of the surge is one-time catch-up from cleared backlogs. Most of it is structural. The cost of finding a vulnerability has collapsed, every new model lowers it again, and attackers have the same tools. curl's maintainer, Daniel Stenberg, has said that each new round of AI scanning keeps turning up new bugs. This is the new normal.
One number has stayed largely flat: vulnerabilities with confirmed exploitation or an EPSS score above 10%, according to the same APNIC analysis. Finding the few that matter among 600 a day is now the whole job.
4. One of eMudhra's intermediate certificate authority private keys was the number 4. Eight of its keys were numbers between 4 and 237 (Mozilla bug 2083449). Anyone could recompute them and sign a trusted certificate for any website. Browsers blocked them within three days. Two days after that, eMudhra announced it was leaving the global TLS certificate business.
2. PHP shipped an emergency release for two remote code execution flaws in the engine itself (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp). Every app running on unpatched PHP was exposed, whatever framework it used.
600. New CVEs a day. The NVD published 4,211 from October 19 to 25. That is one every 2.4 minutes.
Browsers fixed eMudhra fast. Most companies are still finding out where those certificates live in their containers, servers, and runtimes. We released Early Light, free and open source, to answer exactly that question for both of last week's vulnerabilities.
Jason Clinton, Anthropic's Deputy CISO, wrote last week that things are "going to get a lot worse before they get better." His advice to security leaders was to go to their boards now and ask for help with the basics.
He's right. Companies of every size can no longer bury their heads in the sand. These vulnerabilities will be used indiscriminately, against a 20-person startup as readily as against a bank.
AI now finds vulnerabilities faster than teams can fix them. A SANS survey released last week found that 49% of companies need more than a day to close a known critical gap in their cloud security. The same survey found that 93% run production workloads in the cloud, but only 40% call their cloud security strategy advanced. We are more than a decade into the cloud.
Security has always adopted new technology long after engineering. It can't work that way with AI. Humans can't close this gap alone.
Disruption is coming. Security tools have to change, and so do the practices around them. The vendors and teams that don't change won't exist.
That's why we're bringing Mythos-powered code analysis to market. It reasons through a repository the way a strong security researcher does, and it finds bugs no rule set was ever going to catch.
DefectDojo Premium x2 and Enterprise customers get one free through November 13. Request it from the Sensei page in DefectDojo Pro. Everyone else can talk to us about adding it.
Last week was a glimpse. Fight AI with AI.