The death of the 14-day patch: Surviving machine-speed vulnerability discovery
For decades, enterprise vulnerability management ran on human time: A security researcher manually dissected a binary, traced execution paths, built The post The death of the 14-day patch: Surviving machine-speed vulnerability discovery appeared first on The New Stack .
The article titled "The death of the 14-day patch: Surviving machine-speed vulnerability discovery" discusses the rapid acceleration in the discovery of software vulnerabilities in 2026. In the first nine months of the year, 75,242 CVEs were recorded, accounting for about 20% of all vulnerabilities since the CVE program began in 1999.
The pace of discovery has outpaced the ability to remediate these vulnerabilities, rendering the traditional two-week patch cycle obsolete. The surge in vulnerability discovery is attributed to the transformation of vulnerability hunting from an artisan craft to an autonomous, distributed compute problem. Modern agentic security systems now perform full-context semantic analysis, cloning repositories, tracing data flows, constructing exploit payloads, and confirming exploitability before alerting.
Additionally, automated agents continuously traverse open-source package registries and public repositories, testing various software runtimes for vulnerabilities. This shift in vulnerability discovery methods has led to a cascade of operational issues, including an unmanageable exposure gap, alert paralysis, and triage debt.
Brief written by urgent.news from The New Stack's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
