By Hamza Faisal

The world’s software has never been more thoroughly picked apart. New figures from Mitre, the US nonprofit that runs the global Common Vulnerabilities and Exposures (CVE) catalog, show that more than 48,000 publicly disclosed vulnerabilities were logged in 2025 — the ninth consecutive record year — as artificial intelligence helps researchers identify flaws faster than ever before.

The trend line is steep. Registrations ran in the tens of thousands between 2017 and 2020, reached 20,161 in 2021, then soared to 40,077 in 2024 and 48,244 last year. More than 35,000 new cases had already been logged by June 2026. The inflection point arrived in late 2022, when OpenAI’s release of ChatGPT pulled AI into the mainstream — and AI coding assistants and automated bug-hunting tools have since multiplied the number of eyes, human and machine, scanning the world’s code.

A record nobody wanted to break

The raw number tells only part of the story. Analysis of the National Vulnerability Database shows that Mitre itself is no longer even the lead issuer of CVE identifiers, falling to fourth place for the first time. Three companies that secure WordPress installations — Patchstack, Wordfence and WPScan — now account for 23% of all vulnerabilities identified in a single year, alongside the Linux kernel’s own numbering authorities.

That shift matters because it suggests the record is as much about better reporting as about buggier software. “I personally believe that the numbers could easily be 10 times as big if people were reporting everything that they found,” says security researcher Jerry Gamblin, who maintains an analysis of vulnerability data. “Yes, CVEs did grow 21% last year, but that’s not anything to be scared about. We’re just getting better at reporting vulnerabilities, [with large language models, artificial intelligence,] and even more security researchers finding and reporting stuff.”

AI is doing the finding

AI models themselves are now frontline bug hunters. Kyodo reports that systems such as Anthropic’s Claude Mythos are being used to identify security flaws in codebases — part of a broader wave in which AI doesn’t just write software but audits it too.

The urgency is real regardless of how the records are counted. A string of Japanese companies has reported unauthorized access and subsequent information leaks in recent weeks, including the Times Car car-sharing service, prompting the government to urge businesses to tighten security. When flaws are discovered, patches must be applied promptly — delays leave affected systems open to exploitation by attackers.

Patching can’t keep up

The bottleneck is people, not awareness. “Many companies are falling behind in implementing countermeasures due to a labor shortage within the security industry,” said Yukimi Sota of the Japanese branch of US cybersecurity firm Proofpoint.

That mismatch — AI accelerating both discovery and, in the wrong hands, exploitation, while the human workforce that ships patches lags behind — is the defining cybersecurity problem of 2026. The record will almost certainly fall again this year; whether the damage does too depends on how fast the fixes follow.

By Hamza Faisal