Examining the Vulnpocalypse and Defensive Responses

Background

A pervading sense of doom lingers over the information security space, driven largely by a sense that artificial intelligence (AI) has produced a geometric expansion in threats while defense has experienced limited growth in the meantime. One of the key themes in this discussion is the idea of the “vulnpocalypse” – the dramatic expansion of vulnerability disclosures and subsequent exploitation driving intrusions. This discourse reached a peak in October 2026, from a record-setting Microsoft Patch Tuesday to multiple, critical vulnerabilities in key enterprise software and hardware products to critical vulnerabilities in PHP.

This last item concerning PHP gathered particularly spectacular attention in late October 2026, driving fear of internet-wide threats and prompting many organizations to take resources offline following the disclosure of CVE-2026-109168 and CVE-2026-109169. Yet since initial disclosure, it remains difficult to identify active, successful exploitation from any reputable source. As of 25 October, initial signs of possible exploitation and more capable exploit proof of concept (POC) code began to emerge, but nearly a week after disclosure (and despite signs of apparent vulnerability leak with unsuccessful exploitation prior to public disclosure) the internet has still not caught fire.

Given recent events and the overall landscape, prominent leaders in the information security space are on the brink of panic. A sense of being overwhelmed has set in, that defense can no longer keep up with the deluge.

Yet the idea of the vulnpocalypse, and a subsequent “breachpocalypse,” remains largely the domain of intuition and assumption. Intrusions are certainly increasing, with multiple anecdotal reports of incident response firms being saturated and turning away work as a result. Yet the specific reasons behind this saturation remain the realm of speculation as opposed to analysis of specific causes.

Short of pointing at the rising number of issued CVEs, robust analysis and proof of how critical the vulnpocalypse is, and why IT firms are slammed, remains scarce. To really understand the vulnpocalypse, we need to dig deeper to understand trendlines and their implications for information security and network defense professionals.

The Nature of Exploding CVE Numbers

First, it is without question that the number of issued CVEs per year has increased at a geometric rate over the past few years. Simply reviewing National Vulnerability Database (NVD) records since 2020 shows a clear trend in increasing volume. However, while a somewhat flawed metric, an examination of CVE criticality through the Common Vulnerability Scoring System (CVSS) shows that the number of severe or higher vulnerabilities (CVSS greater than or equal to 8.0) has remained a relatively constant proportion of overall CVE numbers at about 30%.

This last point should spark questions: when looking at exploding CVE growth, is the increase in total numbers also paired with an increase in significantly impactful or exploitable vulnerabilities? The static proportion of severe to critical vulnerabilities (30% of all vulnerabilities) means that the absolute number of such items has certainly increased, but the steady proportion indicates that underlying trends in vulnerability type and severity has not changed significantly over the past six years. This may indicate that vulnerability discovery has not shifted towards identifying more severe to critical items as a proportion of all such vulnerabilities, but instead has remained true to longer-term trends. Thus, volume does not appear to reveal anything especially interesting about the vulnpocalypse—but other factors may highlight more worrying trends.

Changing from Volume to Speed

Not all CVEs are alike, and we have already explored one metric by which they differentiate: CVSS. However, CVSS itself does not capture how relevant a CVE is to your infrastructure or how desirable it might be for an adversary to exploit it. For example, a CVSS 10.0 item in an obscure WordPress plugin is arguably far less concerning than a CVSS 7.5 vulnerability in a widely-used, externally accessible enterprise application. 

Likely Exploited Vulnerabilities (LEV) and Exploit Prediction Scoring System (EPSS) scores attempt to define this, but have been inconsistently applied and are subject to revision making historical analysis difficult. These shortcomings make it critically important to be able to measure how relevant and desirable a CVE might be in one’s own particular environment in order to plan and prioritize defenses. Such a measurement is, unfortunately, difficult to develop (and even more difficult to backdate to tens of thousands of vulnerabilities over the past nearly six years).

An alternative to outright adversary desirability may be seen through a proxy: the speed with which a vulnerability is weaponized by threat actors. Since Binding Operational Directive (BOD) 22-01, issued in late 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) has been tasked with tracking and cataloging “known exploited vulnerabilities” (KEV). Created with an emphasis on protecting US government networks, the KEV list identifies those vulnerabilities known to be exploited as a way to help prioritize patching and response. Private organizations like VulnCheck have also created KEV lists with an expanded scope beyond federal networks and applications, widening the view of adversary activity. Irrespective of KEV source, such tracking allows us to differentiate between vulnerabilities that simply exist, and those that are actually being used by adversaries in intrusions.

KEV volume would thus appear to be a valuable item to track alongside CVE volume. However, to really identify the desirability and impact of a vulnerability, the number of items becomes less important than the speed of vulnerability weaponization: time from CVE disclosure to KEV addition. Examining this view of velocity reveals interesting trends.

Looking across both the CISA and VulnCheck KEVs, we can observe a clear trend in exploit velocity. While acknowledging that some artifacts of KEV standup (e.g., adding older vulnerabilities to the newly-formed KEV lists in 2023) bias earlier results, we nonetheless see clear downward pressure on KEV addition times. Over the past two years, the average time to KEV listing has collapsed from nearly 150 days to less than 30 days. This trend is concerning, but importantly only encompasses a fraction of overall vulnerabilities: the total number of KEV additions in 2024 and 2025 was around 600 each year, far less than the ten thousand plus total severe to critical vulnerabilities disclosed in the same timeframe. Thus adversaries are weaponizing and implementing only a fraction of overall vulnerabilities based on available visibility.

Yet an even more important trend is emerging as part of the collapse in KEV addition times. Looking for the past year (September 2025 through September 2026) of available data, a more alarming trend is revealed:

The KEV addition mean time (approximately 37 days for this period) is impacted by a “long tail” of vulnerabilities taking tens or hundreds of days to weaponize. Digging deeper, time to exploitation has collapsed with many vulnerabilities being added to the KEV on the day the CVE is issued, or pre-dating the CVE entirely. This observation highlights an increase in true “zero day” vulnerabilities, items discovered and exploited before a vulnerability is even recorded by the vendor in question.

While overall exploited numbers remain relatively the same, the speed at which items are exploited or discovered has increased dramatically. Given this observation, the volume of vulnerabilities becomes a distraction from the real problem: the rapid identification and weaponization of a far smaller number of critical issues in software and hardware of interest. 

Defensive Implications and Plausible Responses

The collapse of weaponization time for vulnerabilities is the real issue in the vulnpocalypse, not the volume of vulnerabilities. A relatively static proportion of vulnerabilities are weaponized (approximately 600 items in 2024 and 2025, with approximately 500 through September 2026, as seen in the previous chart), but the rate at which they are leveraged has dramatically increased. Whether this is due to adversary interest, applications of AI, or some other reason remains unknown at this time. Irrespective of cause, defenders must react to these events and posture their networks appropriately.

Most importantly given current information, the advice of “just patch” is no longer useful or particularly applicable. The increased identification and exploitation of true zero days and other vulnerabilities alike means even emergency patching cycles would be stressed to keep up in the latter case, and would be irrelevant in the former. Patch management is still  important given there remains the “long tail” of vulnerabilities exploited well after initial disclosure, but on its own is insufficient and unable to cope with the current threat landscape.

Instead, organizations and network defenders need to embrace a far more robust defensive mindset with respect to protecting and monitoring environments. The saying “assume breach” has percolated through the information security space for years. At present, it may be equally if not more important to coin a new phrase: assume exploitation. 

For particularly desirable applications facilitating initial or privileged access to networks, such as VPN concentrators, firewalls, externally-exposed business applications, and similar, adversaries are working diligently to identify and rapidly weaponize weaknesses in these products to facilitate intrusions. Defenders must adapt to this reality and vector defenses appropriately with the assumption that these devices, even if fully patched to the current release, remain fundamentally vulnerable.

Given this state change in network defense, adoption of frequently derided but nonetheless important security strategies (and, admittedly, buzzwords) such as zero trust architecture and defense in depth are necessary steps. With rapid weaponization of items targeting perimeter and related assets, organizations must be attuned to and prepared for the compromise or breach of such assets. This requires robust monitoring of such devices and applications, and examining communication links to these applications as well as from them. Simply, adversaries using a compromised network appliance as an intrusion “beachhead” or gaining initial access via a critical business service must be identified and evicted as soon as practical to contain and prevent a far more extensive and expensive compromise.

Additionally, assets must be hardened and identities protected to the greatest extent possible. Although certainly not invincible, implementing multifactor authentication (ideally via hardware token), least-privileged use, and similar strategies can reduce scope of certain breaches and help contain items. While an adversary may nonetheless get access to the monitored network, such controls may limit initial damage and provide critical time and space to defenders to detect and then respond to such an intrusion.

Finally, organizations must plan for resilience and recovery in the increasingly likely event of a compromise. The former means ensuring backups of data and device configurations, as well as developing, maintaining, and testing procedures to operate in degraded environments (e.g., if systems must be taken offline preemptively or due to a potential incident). 

Organizations must identify ways to ensure continuity of operations and core business functions knowing that exploitation and potential breach are likely eventualities. This extends to restoring operations post-breach, having tested and verified plans in place to detect, isolate, and then mitigate an intrusion as rapidly as possible. Such actions should include both robust internal procedures where processes and resources are present, and pre-event verification as to service level agreements and similar considerations for outside providers such as incident response firms.

Conclusions

The vulnpocalypse is a crisis of speed, not volume. While the number of issued CVEs generates headlines, the true crisis in security is the velocity at which issues accelerate to weaponization, including as true zero day items. On the one hand, this dispels the myth of defenders simply overwhelmed by the sheer number of issued vulnerabilities. At the same time, a different issue arises where many historical defensive recommendations, such as “just patch,” become less than ideal if not outright irrelevant.

In this ecosystem, defenders must leverage their ownership of the network to architect, develop, and implement environments in a way that allows for robust, mutually reinforcing security controls. Networks and asset owners can no longer rely on firm borders and solid walls to keep adversaries out, and the rapid weaponization of weakness means response times are vanishingly small where they exist at all. The result is a need to prepare defenses and environments in advance to minimize attack surface, funnel adversaries toward routes where detection is likely, and invest in resilience and speedy recovery.

Alongside this preparation, adopting a rigorous view of exposure and risk based on analysis of systems and the overall threat environment can unlock specific guidance and appropriate data-driven indicators for hardening, mitigation, and preparation. Predictive Threat Exposure Management (PTEM) is one way of achieving this outcome, and can be used alongside preventative controls for continuous defense and monitoring.

Throwing our hands up and saying the game is lost is simply unacceptable, as tempting as it may be during times of seeming crisis like the present. Through diligent use of security controls, network architecture, and meaningful defense in depth, organizations can rise to meet the challenge of the current threat landscape. Such actions will not be easy, but they are possible and increasingly necessary in an ever more hostile and challenging information security environment.