There's only so much code: the rise in vulnerability numbers

As cited

Copy frozen at 2026-10-20 16:36 UTC (site build).

vulnerabilities

There's only so much code: the rise in vulnerability numbers

Artificial intelligence (AI) models are rapidly discovering vulnerabilities in decades-old code libraries, causing Microsoft's monthly patch advisories to exceed 1,400 this month compared to historical averages of 100. While the absolute number of identified vulnerabilities has surged 105 percent year-over-year, the proportion being actively exploited remains small: only 3 of 975 September Microsoft advisories saw in-the-wild attacks, and known exploited vulnerabilities grew by just 37 percent. As threat actors gain AI-assisted parsing speed, defenders must prioritize high-exploitability flaws in their specific environments, deploy interim mitigations, implement behavioral detection, and integrate AI validation into development pipelines.

Why it matters: All organizations running legacy libraries like log4j (CVE-2021-44228, CVSS 10.0, actively exploited) face increased discovery and disclosure of historical vulnerabilities; practitioners must shift from attempting to patch every advisory to identifying and protecting against the subset with viable attack paths in their environment.

Source published

2026-10-20 15:31 UTC

First seen by Cybersecurity Tracker

2026-10-20 15:36 UTC