AI Changed the Exposure Problem. Validation Needs to Change With It.
Summary: In the first half of 2026, 35,853 CVEs were published, roughly 49% more than the year before, yet only 495 were catalogued as exploited in the wild in that period and 116 were already under attack on the day they became public. The article also cites Anthropic disclosure data showing Mythos-class models surfaced 26,153 vulnerability candidates in open-source software, with only 421 patched upstream, and Omdia research finding that while 95% of organizations rank pentesting a top or high priority, only 32% of their average attack surface is tested each year.
Key Takeaway: With 35,853 CVEs in six months against 495 exploited in the wild, treating every High or Critical CVSS finding as an emergency is not just impossible but the wrong model - and with only 32% of the average attack surface tested annually, most of your estate gets no exploitability verdict at all.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026