This year’s bug count just passed 100K

As of 2026, the count of Common Vulnerabilities and Exposures (CVEs) has surpassed 100,000, marking a new record. This surge can be attributed to the growing influence of artificial intelligence (AI) in vulnerability discovery. Josh Bressers, director of coordinated vulnerability disclosure at VulnCheck, expressed concern over the rapid increase in CVEs, stating that in the coming years, 100,000 may seem like a small number.

Microsoft alone added 1,094 security flaws to the total count on Tuesday, continuing the trend from the previous month when it disclosed 1,474 vulnerabilities. The major CVE Numbering Authorities (CNAs), including VulnCheck, Microsoft, Oracle, and GitHub, are overwhelmed by the sheer volume of vulnerabilities being discovered, attributing the surge to AI.

Additionally, the percentage of exploited CVEs in the wild remains relatively consistent at around 1.4 percent, although this percentage becomes more significant as the number of CVEs grows. The time between the public release of a security patch and the development of working exploits is shrinking, thanks to AI advancements. From January to June, 88 percent of exploitation observed by CrowdStrike occurred within 48 hours of the code's release, with China-linked groups moving even faster, launching attacks within 24 hours.

This trend has intensified during the second half of 2026, with the median time from CVE publication to exploitation falling from 120 days to 80 days. The rapid dissemination of software bugs requires a significant shift in the industry's approach to vulnerability disclosure and patching. Instead of solely focusing on vulnerabilities, organizations should prioritize based on specific risk criteria, such as whether the asset is internet-exposed, under active exploitation, and whether an attacker can automate the exploit.

AI-generated vulnerability disclosures have also posed challenges for open source software developers and maintainers, who are overwhelmed by the deluge of vulnerability reports. To address this issue, the Eclipse Foundation introduced a "managed tier" for enterprise customers, ensuring 99.95 percent uptime and funding its ongoing maintenance.

Similarly, curl's maintainer, Daniel Stenberg, updated the project's bug reporting rules, directing low- and medium-severity reports to the public GitHub repository while only addressing high- and critical-flaws privately. Despite these efforts, significant changes are needed to adapt to the evolving threat landscape fueled by AI.