AI finds vulnerabilities faster than organizations can fix them, and attackers keep pace
Rohan Paul cited data pointing out that AI now discovers software vulnerabilities faster than organizations can fix them. By late July 2026, the U.S. National Vulnerability Database had recorded 45,207 vulnerabilities, close to the record total for all of 2025; a single July update from Google fixed 433 Chrome vulnerabilities, compared with 11 a year earlier, while Oracle fixed 1,449 versus 309. In this week's PHP emergency, banks, airlines, and governments took websites offline because of 2 AI-discovered vulnerabilities; Palo Alto Networks' Unit 42 estimates that more than one-third of the 22 million related internet-exposed systems run software that cannot be patched, and upgrades are expected to take months.
Why read this
AI score 71
The original text compares vulnerability databases with the number of vendor patches, showing an imbalance in which AI finds vulnerabilities faster than they can be fixed.
Topics
Body
AI is finding software flaws faster than organizations can fix them, and attackers are keeping pace.
> The US National Vulnerability Database logged 45,207 flaws by late July 2026, nearly matching all of record-setting 2025.
> Vendors show the same jump: Google fixed 433 Chrome bugs in one July update versus 11 a year earlier, and Oracle patched 1,449 against 309.
> This week’s PHP emergency showed the result, as banks, airlines and governments pulled sites offline over 2 AI-found flaws.
> Exploited flaws haven’t risen yet, largely because companies find most bugs themselves, as Google did with 401 of its 433.
> Palo Alto Networks’ Unit 42 estimates that more than a third of 22M internet-exposed systems vulnerable to the PHP flaws run software that can’t be patched, and expects upgrades to take months.