There's only so much code: the rise in vulnerability numbers

What it is

Cisco Talos argues that the jump in Microsoft Patch Tuesday advisories (about 100 a month before June 2026, 975 in September, 1,415 in October) comes from frontier models, Mythos in particular, working through old code in widely used libraries and tools. The authors say disclosure does not equal weaponization, so the volume alone does not signal an exploitation wave.

How it works

• The page says the models have not found a new vulnerability class. They find known types faster and more thoroughly.
• Talos calls the likely trajectory a bug-class curve and cites format string bugs: identified in 2000, peaking in 2005, then declining over the next few years. They remain a smaller share of yearly CVEs. Talos says AI-assisted discovery "could" follow the same path, as the backlog is cleared and AI checks run on new code. This is an analogy, not a measurement.
• On exploitation, KEV additions rose 37% against 105% for published CVEs. Talos says the two need not scale together, because attackers need only enough useful bugs and reuse them across targets. KEV counts distinct vulnerabilities, not attacks.
• The risk Talos names is shorter time to exploit. Attackers have long diffed vendor patches to find the bugs, and patch volume used to bottleneck human analysts. AI removes that bottleneck. Attackers often chain three or more vulnerabilities.

What to do

• Writing code: add AI review to the build chain, using models at least as current as those used for hunting. Running new code through is cheap. Running a large backlog is expensive, so do it in chunks.
• Operating systems and tools: upgrade quickly, then add layers.
• Prioritise flaws with the highest exploitability in your own environment, not the advisory count.
• Cisco customers: use LiveProtect to cover the gap between advisory day and patching, "for everything you own".
• Replace static domain blocking with behavioral detection that alerts on anomalous traffic toward automation platforms.
• Write custom IPS/Snort rules with SnortML to block traffic aimed at unpatched flaws.
• Keep several overlapping protections to cover patch delays.

Caveats

• Talos itself says guidance on disclosure is "in flux". Many researchers now publish with no 90-day window, reasoning that any other model could find the same bug.
• Open-source projects are described as flooded. Some have a trusted patching group and some ask the whole community. Larger vendors are said to be coping "for now".
• The log4j (CVE-2021-44228) example is used to show that ubiquitous, uncatalogued components blindside defenders. The post gives no inventory method.
• The advice names Cisco products (LiveProtect, SnortML) and gives no thresholds or tooling beyond those. Talos also says it has had to add resources to deliver MAPP-based detection on time for Microsoft.