Ethical Hacking News
As the number of Common Vulnerabilities and Exposures (CVEs) recently disclosed by VulnCheck surpasses 100,000, the AI-induced vulnpocalypse is raising concerns about the rapid pace of vulnerability discovery and exploitation. The industry is in need of a sea change in how vulnerability disclosure and patching are approached to address this growing threat.
The number of Common Vulnerabilities and Exposures (CVEs) has increased to 100,222, surpassing the previous year's total by more than double. The rise of artificial intelligence (AI) is driving the increase in CVEs through AI-driven vulnerability hunting. The window between the public release of a security patch and the development of working exploits by attackers is rapidly shrinking. The median time from CVE publication to exploitation has fallen from 120 days to 80 days in 2026. The need for a sea change in how vulnerability disclosure and patching are approached is urgent due to the AI-induced vulnpocalypse. A new approach to vulnerability management is required to address the rapid pace of vulnerability discovery and exploitation.
The cybersecurity landscape has never been more treacherous, with a staggering 100,222 Common Vulnerabilities and Exposures (CVEs) recently disclosed by VulnCheck. This figure surpasses the previous year's total by more than double, and the reason behind this alarming increase can be attributed to the rise of artificial intelligence (AI). The AI-induced vulnpocalypse, as it has come to be known, is a pressing concern that requires immediate attention from the industry.
According to Josh Bressers, VulnCheck's director of coordinated vulnerability disclosure, the influx of software bugs is a result of AI-driven vulnerability hunting. "The thing that almost scares the bejesus out of me is while 100K sounds like a lot, in a couple years we're going to say, remember when it was only 100K?" Bressers noted during an interview. "There's no denying the fact that vulnerability hunting with AI is driving a majority of what we're seeing."
The growing number of CVEs has significant implications for organizations, particularly those that rely on AI-powered systems. As the number of vulnerabilities continues to rise, the window between the public release of a security patch and the development of working exploits by attackers is rapidly shrinking. In fact, CrowdStrike found that 88 percent of exploitation observed using public proof-of-concept (PoC) code occurred within 48 hours of the code's release, with China-linked groups such as Vault Panda and Genesis Panda launching attacks within 24 hours of disclosure.
The speed at which vulnerabilities are being exploited is also a cause for concern. VulnCheck found that the median time from CVE publication to exploitation fell from 120 days in 2025 to 80 days during the first half of 2026. This trend has continued during the second half of the year, with some vulnerabilities being exploited within mere hours of publication.
The AI-induced vulnpocalypse has far-reaching consequences for the industry, including the need for a sea change in how vulnerability disclosure and patching are approached. "We don't have a security problem anymore," Bressers said. "We have a data problem now. Instead of obsessing over vulnerabilities, we need to start looking at things like heat maps for infrastructure, and figure out the vulnerabilities that actually affect you."
To address this issue, the US Cybersecurity and Infrastructure Security Agency (CISA) recently issued a cybersecurity directive that replaces flat-deadline vulnerability management policies. The directive instructs organizations to prioritize patching based on specific risk criteria, including whether the asset is internet-exposed, under active exploitation, and whether an attacker can automate the exploit.
The impact of AI on vulnerability disclosure is also having a significant effect on open source software developers and maintainers. As AI-generated vulnerability disclosures flood in, individual developers are struggling to keep up, with some foundations being "crushed" by the sheer volume of reports. The Eclipse Foundation, which houses the Open VSX Registry, has responded by launching a "managed tier" for enterprise customers and other organizations running Open VSX at scale. This paid option guarantees a 99.95 percent uptime SLA backed by service credits, with commercial users helping to fund the ongoing maintenance and security of the registry.
As the industry grapples with the implications of the AI-induced vulnpocalypse, it is clear that a fundamental shift is needed. The way we currently approach vulnerability disclosure and patching is no longer sufficient, and a new approach is required to address the rapid pace of vulnerability discovery and exploitation. As Bressers noted, "The one thing I can say with certainty is: The way we currently do things has to change, and it's going to have to change fairly soon."
Related Information:
https://www.ethicalhackingnews.com/articles/This-Years-Bug-Count-Just-Passed-100K-The-AI-Induced-Vulnpocalypse-ehn.shtml
https://www.theregister.com/security/2026/11/13/this-years-bug-count-just-passed-100k/5309882
Published: Fri Nov 13 16:14:56 2026 by llama3.2 3B Q4_K_M
