The cybersecurity industry is confronting a threat landscape that is changing faster than most defenders can keep track of. New data from Epoch AI shows that critical and high-severity vulnerability disclosures from major technology firms have gone vertical since the beginning of this spring, climbing from a baseline of a few hundred a month to well over 600, with critical-severity CVEs alone jumping from single digits to more than 600 in recent months.
By June 2026, twenty-one notable organizations, including Microsoft, Google, Apple, Adobe, Oracle, Cisco, and IBM, disclosed around 1,500 high- and critical-severity CVEs, more than 3.5 times the previous monthly record set before the release of Anthropic’s Claude Mythos Preview.
Critical Software Vulnerabilities Surge
That surge did not stop there; by July, disclosures reached roughly 2,500, nearly five times the pre-Mythos baseline and 60 percent above June’s already record-breaking total.
Researchers point to Anthropic’s Project Glasswing, an AI-powered vulnerability discovery initiative, as a major driver behind the spike, with the effort reportedly surfacing more than 10,000 high- or critical-severity flaws, many of which have not yet been individually disclosed.
Whether this reflects a genuine increase in exploitable weaknesses or simply a change in how vulnerabilities are found and classified remains uncertain, but analysts agree that AI-assisted discovery tools have fundamentally altered the pace at which flaws surface.
Compounding the disclosure surge is a parallel collapse in the time attackers need to weaponize new flaws. According to ZeroDayClock, the zero-day rate, meaning the share of exploited vulnerabilities attacked on or before the day of public disclosure, has climbed to nearly 87 percent, up roughly 60 percent from last year and almost quadruple the rate recorded in 2020.
The median time to exploit now sits at around one day, and some researchers project it could shrink to just one minute by next year. As recently as 2018, the median gap between disclosure and first observed exploitation stretched to 771 days; by 2023 that window had fallen to roughly six days, and by 2024 it was down to hours.
The so-called exploit survival curve, which tracks what percentage of eventually-exploited CVEs remain unexploited over time, now falls to zero within about 1.5 months of disclosure, reads the report.
In 2022, half of all exploits that would ever be weaponized were still unexploited at the 1.5-month mark, and even at three months a substantial share had gone untouched. Today, defenders effectively have no cushion once a flaw becomes public.
Security teams prepared to patch cycles measured in weeks are now operating in an environment where exploitation can begin before a fix is even available.
Ransomware operators have already adapted, with more than half of ransomware-linked CVEs in 2025 first identified through zero-day exploitation, up sharply from the prior year.
Industry analysts note that AI is reshaping both sides of the equation, accelerating offensive discovery while also promising to strengthen automated defense and detection capabilities. For now, organizations that delay patching by even a few days are increasingly likely to find that attackers got there first.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Critical Software Vulnerabilities Surge From Under 100 to More Than 600 a Month appeared first on Cyber Security News.