You've probably heard several apocalyptic cybersecurity news stories in the last week or so. We've been drowning in new vulnerabilities, according to their authors.

Well, they aren't necessarily wrong. However, they don't tell the whole story.

AI has made it much easier to find vulnerabilities in software and hardware. It has not necessarily made it easier to exploit those vulnerabilities, though.

While we track discovered vulnerabilities through a systems called CVE (Common Vulnerabilities and Exposures), we also track Known Exploited Vulnerabilities through a system called, well, KEV. The latter is a bit more representative of the danger than the mere existence of a vulnerabilities. Still, both of these systems do not represent the severity of the flaw, only its existence. There are several ways to measure that, each with their own strengths and flaws.

MAN, CYBERSECURITY IS COMPLICATED!

An easy way to communicate the increase in discovered vulnerabilities that's relatable by most is the volume of patches released by Microsoft each month. You've probably heard of Patch Tuesday, when the bomb drops for us in the cybersecurity world. 

Microsoft's Patch Tuesday release in July of this year was almost 3 times as large as what was released in June. September was almost 5x the scale of June and October was just over 7x June's scale. That's a lot of vulnerabilities! Or, if you're Southern - "Mayonnaise alotta vulnerabilities" (say it out loud, but don't laugh too hard).

On the exploited side of the house, we are expecting about the same percentage increase in exploited vulnerabilities from 2025 to 2026 that we saw from 2024 to 2025 (roughly, 35%). That's nothing to sneeze at or be proud of, but it's not the civilization-ending tsunami that you'd think from reading most news sources.

From one of the stories you may have seen last week, the Internet as you know it was burning to the ground. Or that's how they sold it. What really happened was that an AI platform discovered some vulnerabilities in PHP, a framework that does indeed run much of the Internet. Fortunately for us, those vulnerabilities are proving very difficult to exploit. They are not unexploitable, but it's proving to be a tough task. And if there's one thing that hackers don't like, it's work.

In the industry, we see these stories almost weekly now. The people with skin in the "selling you things" game want you to be perpetually afraid so you will buy their stuff. It does take a little more work, but the real story can be found just behind the sensationalism and is usually not quite so dire.

So what does this mean?

• The hype train is going strong. The main stream news takes a feed from the cybersecurity industry news and the industry news has products and services to sell with that fearmongering.
• There is still a need to take care of these vulnerabilities, but we need to prioritize our efforts. Many of those Patch Tuesday vulnerabilities are patched automatically if you are doing things right.
• Cyber hygiene is the way to go. Automate away as much of your patching as possible so you can focus on the things that can't be automated (e.g., core device firmware, web infrastructure, components to larger systems). 

Bottom line: Don't ignore it, but get the ground truth before taking any action or making any purchases.

References:
https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/
https://cyberpresso.com/blog/cisa-kev-statistics-2026