This Year’s Bug Count Just Passed 100,000, Double 2025’s Total
The number of publicly disclosed software security flaws in 2026 passed 100,000 on Friday, more than double last year's total. VulnCheck's Josh Bressers blames AI-driven bug hunting and says attackers now exploit new flaws within hours, forcing a rethink of patching.
This year’s bug count just passed 100,000. The number of Common Vulnerabilities and Exposures (CVEs) disclosed in 2026 crossed that line on Friday, November 13, more than double the total for 2025. A CVE is a public ID number assigned to a single security flaw.
The reason, according to security firm VulnCheck, comes down to two letters: AI.
“It’s kind of wild,” said Josh Bressers, VulnCheck’s director of coordinated vulnerability disclosure. At about 4 pm UTC on Friday, VulnCheck counted 100,222 CVEs.
AI-driven bug hunting
Bressers said AI-assisted vulnerability hunting is behind most of the surge. The organizations authorized to hand out CVE numbers, including VulnCheck, Microsoft, Oracle and GitHub, “are just screaming into the atmosphere right now,” he said.
Microsoft alone added 1,094 security flaws in its latest batch. The month before, it added 1,474.
Bressers sounded a warning about the pace. “In a couple years we're going to say, remember when it was only 100K?” he said.
Exploits arrive faster
The share of flaws that attackers actually exploit has stayed fairly steady. VulnCheck has added about 1.4 percent of this year’s CVEs, or 1,363, to its Known Exploited Vulnerabilities catalog. But 1 percent of 100,000 is a far bigger workload than 1 percent of 1,000, Bressers noted.
The time between a patch going public and a working attack is shrinking too. CrowdStrike said 88 percent of the exploitation it observed using public proof-of-concept code from January to June happened within 48 hours of the code’s release. It said China-linked groups such as Vault Panda and Genesis Panda moved faster still, attacking within 24 hours of disclosure.
VulnCheck found the median time from CVE publication to exploitation fell from 120 days in 2025 to 80 days in the first half of 2026. Bressers said the window has narrowed further in the second half.
“It’s often just hours,” he said.
Minutes, not days
He pointed to 14 vulnerabilities VulnCheck disclosed on Friday in Copeland refrigeration controllers. The flaws let an attacker gain full control of a device. Two are already under active exploitation. These are the devices Iranian hackers abused to spoil food and spark fires in supermarkets across Europe.
“We published those CVEs, and literally minutes later, we were seeing hits on our honey pots,” Bressers said. A honeypot is a decoy system set up to attract attackers.
A different way to patch
Bressers argued that the industry has to change how it handles disclosure and patching. Chasing every flaw no longer works at this scale.
“We don't have a security problem anymore,” he said. “We have a data problem now.” He said organizations should build heat maps of their infrastructure and focus on the vulnerabilities that actually affect them.
