AI and the October 2026 vulnerability storm: what the numbers show
On 21 October 2026, PHP patched two flaws that allow remote code execution without logging in, and several European government agencies took websites offline to patch. Through October, critical bugs kept arriving in quick succession. Is AI making software less secure, or just making old bugs surface faster? The short answer: disclosed vulnerabilities have doubled this year and AI-credited finds…
On 21 October 2026, PHP released emergency security updates to patch two critical remote code execution vulnerabilities. This marked the start of a month-long surge in newly discovered critical bugs. AI-assisted vulnerability discovery skyrocketed, with the number of CVEs credited to AI systems increasing more than 20-fold compared to the previous year.
However, the actual exploitation of these vulnerabilities remained relatively low, growing only about 20% compared to the overall growth in disclosed vulnerabilities. The bottleneck in mitigating the threat now lies with software maintainers who must patch the vulnerabilities. While AI played a role in finding many of these flaws, it did not create the underlying vulnerabilities themselves.
The real impact of AI on software security may lie in its ability to accelerate the discovery process, but the ultimate safety of software still depends on timely patching and responsible use of these newly exposed vulnerabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
