October was Cybersecurity Awareness Month. It became vulnerability month.

Hello Cyber Builders 🖖

October is Cybersecurity Awareness Month. This year it was the month of vulnerabilities.

The ‘vulnpocalypse‘ went from the security Twitter feeds to the general press. This week I’m looking at the numbers to see what’s actually going on and what’s just noise. I am a fan of buzzwords, and I wanted to compile numbers to be sure of what is happening.

The flood is very real and far more substantial than most people realize. The volume of attacks isn’t escalating at the same rate. On the defensive side, CISOs have more budget than ever but are still not in a position to let AI do the work for them. This post looks at those two gaps.

Let’s start with publication.

• In 2025, 48,185 CVEs were published (roughly 924 a week).

• In October 2026 alone, 17,052 CVEs were published. That’s about 3,850 a week, four times last year’s rate. I checked that figure against the NVD myself.

• In Feb, FIRST was forecasting a record year. By June, their 2026 forecast had been raised to around 66k CVEs. The actual figure passed 66k in September. My own forecast for Cyber Builders (taking Jan-Oct as published and Nov/Dec at the early Nov pace) is around 128k for 2026. That’s 2.7x 2025.

The institutions that we all depend on are falling behind. In April 2026, NIST stopped enriching every CVE in the NVD. Some 29,000 older CVEs will never be enriched: no severity score, no list of affected products. Tools that depend on that list will miss those CVEs on your assets.

NIST now enriches only the CVEs in CISA’s KEV catalog (software the US government uses and that’s deemed critical). Everything else gets a number and the label “Not Scheduled”.

Europe has already started to build its own alternative (https://euvd.enisa.europa.eu/).

The flood didn’t come out of nowhere. Follow the last eighteen months:

Who found which CVE is disputed. The volume of it is not.

AI finds the flaw. AI writes the exploit. AI writes the report to the maintainer. Of course, the attackers then use the same AI to attack you.

Exploitation is getting faster. Mandiant’s time to exploit has gone from 63 days in 2018-2019 to an estimated minus 7 days in M-Trends 2026. On average, attacks start before the patch. Bain estimates that AI reduces the typical attack sequence from around four weeks to around 18 hours.

Two October stories to illustrate what this looks like.

On 21 October, PHP released fixes for two critical RCE bugs (CVE-2026-109618 and CVE-2026-109619), both scored 9.2. These affect all PHP installations that are serving web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). There is no fix for PHP 8.1 and earlier, and CISA states those systems should be taken offline.

On 26 October, five days later, CISA added both CVEs to its Known Exploited Vulnerabilities catalog.

For a mid-sized company, PHP is embedded in dozens of products that aren’t immediately obvious (a CMS, a support portal, an appliance admin page). It took five days to find them all. Most teams would take five days just to build the inventory.

On 19 October, Reuters reported on a campaign Snorre Fagerland of NorForge uncovered. A Chinese-speaking operator was seen pointing open-source Cairn agents at company websites with instructions of under 100 characters. Fagerland was able to read the attacker’s control panels, which were left completely open. Over 1,200 sites in the US, Canada, Australia and Japan were attacked with over 1,100 attack projects in a single cluster. More than 100 companies’ sites were compromised (Deere, SharkNinja, Cummins amongst them).

On average, the agents took 23 hours to get in, with roughly 1 in 10 attempts succeeding. NorForge estimated that each task cost about $5 and the whole campaign about $5,000 in AI tokens.

If you count in all the failed attempts as well then it’s still about $50 per successful hack.

They did not need anything exotic. The break-ins exploited old, known weaknesses: memcached sessions, unsafe PHP objects, and outdated Zend Framework code.

Many websites are still years behind. Agents can test every exposed site cheaply, so every company has to check its own every week.

We could not establish how much data was stolen. The attackers’ return is unknown. At $50 a hack, the return is likely high.

This part does not fit the apocalypse story.

Only a small share of CVEs are ever exploited. Only 1.4% of new CVEs are exploited in the first half of 2026; other counts range from 1 to 5%. At October’s volume, that is about 50 a week. The CISA KEV catalog holds 1,769 CVEs today, about 0.44% of all CVEs ever published.

KEV is not exploding. CISA added 245 CVEs to KEV in 2025, and 285 so far in 2026 (as of 6 November).

That is 6 to 7 a week, 16% more than last year, while publications have more than doubled.

There are three possible explanations, and no one can pick one with confidence today.

1. Tons of attacks are not caught. Exploitation grows, but our detection does not see it, so it never becomes a KEV entry.

2. The pipeline is overloaded. KEV depends on evidence reaching CISA and on people to process it. With NIST no longer enriching most CVEs and budgets cut, the public pipeline may simply lag behind.

3. Attacks no longer map to one CVE. They discover and use their own “way forward.” This is the most likely explanation. Call it exploit, vulnerability… only the outcome matters.

Tal Be’ery asked a good question last week: are vulnerabilities sparse or dense? He looked at Chrome’s patch history, and his answer is dense. Google fixed 1,072 security bugs in Chrome 149 and 150 alone—more than in the 23 milestones before them combined. I will come back to his article in my next post. Here is why it matters for the numbers.

If the number of vulnerabilities is finite, you can map every attack back to a CVE. Count the CVEs exploited, and you know how much exploitation there is.

If it is dense, with endless variants, an AI agent attacking you does not need the published bug. It can use a variant, a slight modification, or a sibling bug in the same code that nobody has reported yet. I would not call it a zero-day in the classic sense. But it is not the CVE on your list either.

The Cairn campaign is a hint. In one documented case, the agents failed against the main application, found an exposed admin interface, and then found a command execution flaw there. Which CVE do you attach to that? Maybe none.

And the biggest heist of the month did not need a CVE at all. On 29 October, attackers stole about $6.3 billion from Binance, the largest crypto theft on record. According to NPR, the way in was a Binance engineer who thought he was being interviewed for a job. Binance froze close to $3 billion before it could be laundered and says it will cover the rest. The theft is attributed to a North Korea-linked group, though North Korea denies it. Who is on the other side? Organized crime and state-backed groups after money—through ransomware, stolen identities, or straight theft. They use whatever works, and a CVE is only one option.

If that is right, the KEV count will understate real exploitation more and more. Attackers will keep working. Their attacks will just stop fitting the CVE accounting.

So what are CISOs doing about it? Andreessen Horowitz published The New Security Agenda on 28 October, a survey of 100 CISOs at US companies with more than 1,000 employees. A few numbers stood out for me.

87% expect their security budget to grow in 2027. Nearly half expect their team to grow, and about half expect it to stay flat. Read that together: for half of them, the extra money goes to tools and automation. A flat team cannot read four times more CVEs. The extra budget has to buy capacity that grows with the flow.

AI is everywhere in their companies. 92% report employees using generative AI tools, 83% use coding assistants or agents, 55% run MCP servers or similar agent integrations. But AI in security is still young: 18% run AI SOC tools in production, and 13% use AI for offensive security or for exposure and vulnerability remediation. Yet exposure and vulnerability management is, with SIEM, their top priority for 2026.

Trust is still the main barrier.

Today, only 36% are comfortable letting AI agents act alone on low-risk tasks.

Take suspending dormant accounts: no one can log in, nothing is deleted. Harven, a CyGO company, already automates this. Even so, just a third of CISOs would let the machine do it. The positive sign: 60% expect to be comfortable in twelve months. Offensively, 18% run most testing continuously in production now, and 52% plan to within a year.

This is the gap. Attackers already automate discovery and exploitation. Defenders know they need automation, but most are not ready to let machines act.

What you do next depends on your role.

You face two problems. First, volume.

Enterprises talk about “hundreds of thousands of vulnerabilities,” but that counts findings, not unique CVEs. Out of tens of thousands of findings, only a few hundred CVEs are known exploited or likely to be. Free sources like KEV and EPSS help you focus—use them before buying tools.

Track your backlog: with 1,000 assets, expect about 50,000 open findings. Most fix 10 to 15% per month. Large companies still have 45% open after a year.

Second, speed.

php2shell gave you five days. Measure your time from “exploited” to “fixed or mitigated” on your most exposed systems. Assume you will get breached. Check the basics: what connects to what, where sensitive data lives, and what’s encrypted.

Three things.

Bring proof, not potential. In the a16z survey, 67% of CISOs want to prioritize based on validated exploitability, 70% want to retest and confirm fixes, and 57% want fixes or tickets created automatically.

Build for real volume. Too many demos show three rows in a table. A mid-sized company with 1,000 endpoints has 20,000 to 120,000 findings. Large customers have twenty times more.

Know your place in the buying process. When CISOs need something new, 44% go to their current platform, 21% to an AI-native vendor, and 47% pick a start-up to fill a gap. Start-ups win by doing what platforms cannot.

Let me conclude by sharing a story: last week, we had a CISO meeting. One CISO came to me after the meeting; it was 9 pm. He said “Thanks for invitation Laurent, I have to go, we’ll share a drink next time”. I said, “Sure. Any urgency?” He told me, “I am going back to the office for our crisis cell; too much patching”

October was noisy. November will likely be noisier. Sending strength to all security professionals, whatever they are doing.

Laurent 💚