This year’s bug count just passed 100K

The number of reported vulnerabilities has surged past 100,000 in 2026, marking a significant increase from the previous year and highlighting the growing impact of artificial intelligence in the cybersecurity landscape. Josh Bressers, director of VulnCheck, attributed this surge to AI-driven vulnerability hunting, noting that the pace of exploitation is accelerating.

Major tech companies and organizations are reporting a staggering number of CVEs, with Microsoft alone adding over a thousand vulnerabilities in a single month. The time between a vulnerability being disclosed and exploited has drastically reduced, with some attacks occurring within hours of a patch's release. This rapid escalation in vulnerability disclosure and exploitation necessitates a shift in how the industry approaches security, moving from a focus solely on vulnerability management to a more risk-based approach.

Open source projects are struggling to cope with the deluge of vulnerability reports, leading some to implement stricter reporting guidelines. The US Cybersecurity and Infrastructure Security Agency (CISA) has also issued new directives, emphasizing prioritization based on specific risk criteria rather than just patch severity. The shift towards a data-driven approach to cybersecurity is becoming increasingly necessary to address the exponential growth in vulnerabilities.