THE CRUNCH

The number of CVEs, the unique identifiers assigned to publicly disclosed security vulnerabilities, passed 100,000 on Friday, more than double the total for all of 2025. VulnCheck, a CVE Numbering Authority authorised to assign those identifiers, counted 100,222 by late afternoon UTC. Josh Bressers, the firm's director of coordinated vulnerability disclosure, credits AI-assisted vulnerability hunting for the bulk of the surge, saying major numbering authorities including Microsoft, Oracle and GitHub are "just screaming into the atmosphere right now".

The raw numbers back the scale of the flood: Microsoft alone added 1,094 flaws on Tuesday, on top of 1,474 the month before. Yet the share of bugs actually exploited in the wild has stayed roughly steady at about 1.4 percent, or 1,363 of this year's CVEs in VulnCheck's Known Exploited Vulnerabilities catalogue. As Bressers puts it, one percent of 1,000 is very different from one percent of 100,000.

The more worrying shift is speed. VulnCheck found the median time from a CVE's publication to exploitation fell from 120 days in 2025 to 80 days in the first half of 2026, and Bressers says it is now often just hours. When the firm disclosed 14 privilege-escalation flaws in Copeland refrigeration controllers on Friday, two of them under active exploitation, it saw hits on its honeypots within minutes. CrowdStrike separately observed that 88 percent of exploitation using public proof-of-concept code from January to June happened within 48 hours of that code's release, with some China-linked groups attacking within 24 hours of disclosure.

The volume is also straining the people expected to handle it. Open source maintainers are, in Bressers' words, drowning in reports: curl's maintainer Daniel Stenberg shut its bug bounty this year as AI-generated submissions piled up, and from 26 October routes low- and medium-severity reports straight to its public GitHub repository. The Eclipse Foundation launched a paid managed tier for its Open VSX Registry in April, with customers including AWS, IBM and Google, so commercial users help fund maintenance.

In numbers

Median time from CVE to exploit

2025

120

days

−33%

First half of 2026

80

days

Figures from The Register, as quoted in this brief.