AI 找漏洞速度超过组织修复速度，攻击者同步跟进
AI is finding software flaws faster than organizations can fix them, and attackers are keeping pace.
Rohan Paul 引用数据指出，AI 发现软件漏洞的速度已快于组织修复速度。美国国家漏洞数据库到 2026 年 7 月下旬记录 45,207 个漏洞，接近 2025 年全年创纪录总量；Google 一次 7 月更新修复 433 个 Chrome 漏洞，一年前为 11 个，Oracle 则修复 1,449 个对 309 个。本周 PHP 紧急事件中，银行、航空公司和政府因 2 个 AI 发现的漏洞下线网站；Palo Alto Networks 的 Unit 42 估计，2200 万个暴露在互联网的相关系统中超过三分之一运行无法打补丁的软件，升级预计需要数月。
正文
AI is finding software flaws faster than organizations can fix them, and attackers are keeping pace.
> The US National Vulnerability Database logged 45,207 flaws by late July 2026, nearly matching all of record-setting 2025.
> Vendors show the same jump: Google fixed 433 Chrome bugs in one July update versus 11 a year earlier, and Oracle patched 1,449 against 309.
> This week’s PHP emergency showed the result, as banks, airlines and governments pulled sites offline over 2 AI-found flaws.
> Exploited flaws haven’t risen yet, largely because companies find most bugs themselves, as Google did with 401 of its 433.
> Palo Alto Networks’ Unit 42 estimates that more than a third of 22M internet-exposed systems vulnerable to the PHP flaws run software that can’t be patched, and expects upgrades to take months.