AI is finding bugs faster than anyone can patch

Monthly CVE disclosures doubled in 2026. A big reason is AI: models have become good at reading code and finding serious bugs.

Some numbers: - Anthropic said its Mythos model surfaced more than 10,000 high- or critical-severity bugs in its first month of limited availability. - About half of AI-discovered vulnerabilities lead to remote code execution (an attacker running their own code on your system), compared with about a quarter of other vulnerabilities. - PHP2Shell, the two critical PHP flaws fixed in October 2026, was found with the help of AI.

Attackers use AI too. Microsoft warns that attackers use it to find flaws, write phishing messages, build malware and break into networks. One reported campaign used autonomous AI agents against more than 1,200 websites, at roughly $50 per successful intrusion.

What it means: the time between a flaw being found and being attacked keeps shrinking. Waiting weeks to patch is no longer safe.

What to do: - Patch faster. Treat critical updates as this-week work, not next-quarter work. - Turn on automatic updates for your website software, plugins, operating systems and apps wherever you can. - Reduce what you expose. Remove plugins, admin panels and old test sites you do not use, and stop your server from showing software versions to visitors. - Know what you run. Keep a simple list of your sites, software and versions, so you can act quickly when the next big flaw lands.