Loading story…
FIRST reported that 2026 vulnerability disclosures are running far above expectations, with cumulative CVE volume tracking 46.3% above its original forecast and adding roughly 6,420 excess entries, pushing the projected annual total to about 66,000. The organization attributed the surge to AI-assisted discovery and broader reporting pipelines tied to tools and programs including Anthropic Mythos, OpenAI GPT-5.4-Cyber, GitHub Security Advisories, and VulnCheck. Despite the jump in raw disclosures, FIRST said practical defender risk appears more stable when filtered through exploitability signals such as CISA KEV inclusion or EPSS scores above 10%, and warned that AI-generated ephemeral software may create short-lived “micro-vulnerabilities” that never reach traditional CVE registries.
Security practitioners said the growing volume is colliding with persistent limits in AI-based triage. Dark Reading reported that large language models still struggle to reliably find and prioritize vulnerabilities for application security teams, producing high false-positive rates, inconsistent results, and weak understanding of code reachability and deployment context. Pixee CTO Arshan Dabirsiaghi said organizations are being flooded by vulnerability findings and dependency update noise without enough staff to validate issues at scale, reinforcing FIRST’s view that the bottleneck has shifted from discovering bugs to human verification, coordination, patching, and detection engineering.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-06-15, FIRST published its mid-year 2026 vulnerability forecast update, reporting that cumulative CVE volume was running 46.3% above the original forecast and raising the projected 2026 total to about 66,000. The report attributed the increase primarily to AI-assisted vulnerability discovery and expanded reporting activity, while arguing that exploitability-filtered risk remained comparatively stable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026
Security leaders are warning that **AI is accelerating zero-day discovery and exploit development**, compressing the time between vulnerability introduction, disclosure, and real-world abuse. A featured discussion of the **"Zero Day Clock"** argues that attackers benefit from a structural advantage because offensive validation is fast and binary, while defenders face slower, costlier verification and patching cycles; the result is a widening gap when organizations still operate on remediation timelines measured in weeks while active exploitation can begin in days. The reporting frames this as a material risk to enterprise resilience rather than a theoretical concern, especially as AI lowers the skill barrier for finding flaws in widely used software. One relevant reference also examines how **AI-enabled cyber operations** are becoming more autonomous, adaptive, and scalable, including target selection, phishing, and tactical decision-making without constant human direction. While focused on state espionage and policy implications rather than vulnerability research specifically, it supports the same broader development: AI is changing the speed and economics of offensive cyber activity. The remaining references are not about this event or topic; they cover detection strategy metrics, a personal newsletter essay, commercial spyware policy, software liability commentary, and a detection engineering newsletter, making them separate issues rather than part of the same story.
Jun 29, 2026