Picture a Tuesday morning. Your IT lead forwards you a headline: security researchers expect a record number of software vulnerabilities this year, and one new flaw is said to touch most of the web. The subject line says “FYI”. The message does not say what you are supposed to do about it.
If you run a mid-market company, the honest answer is that you are supposed to read it correctly, and that is harder than it sounds.
The numbers are real, and the usual reading, that software is getting worse and your risk is exploding, is mostly wrong.
The numbers are real, and the usual reading, that software is getting worse and your risk is exploding, is mostly wrong. This article is about the better reading, the condition attached to it, and the one thing a CEO should insist on.
The Number Behind the Headline
Each publicly tracked software flaw gets an identifier called a CVE. FIRST, the Forum of Incident Response and Security Teams, is a global association of security response teams that also runs the Exploit Prediction Scoring System, known as EPSS. Its forecasting team, Jerry Gamblin and Eireann Leverett, publishes a yearly projection of how many CVEs the world will see. In June 2026 it raised the projection to approximately 66,000 for the year, up from a February median of 59,427, and said the count could approach 70,000 for the first time. Through April, FIRST counted 6,420 more CVEs than its February model expected, about 46 percent above the baseline for that period.
Two cautions about the number. It is a forecast from a statistical model, not a count, and FIRST says its earlier intervals were as wide as 100,000, so treat 66,000 as a direction. And the headline figure includes housekeeping. Some databases backfilled old records and absorbed unassigned backlogs, which inflates the totals without any new flaw being found, according to FIRST and the news coverage of its report.
What FIRST Says It Means
FIRST’s central message is about interpretation. Its press release says the surge reflects more aggressive security research and better reporting, not a decline in software security. Leverett put it simply, saying the volume is not because software is suddenly less secure. FIRST’s blog calls the spike in discovery volume something that does not equal an unmanageable crisis, and advocates calm growth in exposure management instead of a panic-driven narrative.
The reasons it gives are worth knowing. AI-assisted tooling is finding flaws that human reviewers missed; FIRST points to a 164 percent jump in first-quarter disclosures from Mozilla, tied to AI tooling run against Firefox, and to Mozilla’s account of 271 bugs fixed in a single release. Reporting organizations are also expanding and clearing backlogs. And software itself keeps growing, with open source projects getting serious scrutiny for the first time. FIRST admits it is still learning how to separate software growth from AI discovery, so we should not pretend to know the split either.
Not every report is a real flaw. VulnCheck, a vulnerability intelligence vendor with a product to sell, notes that a maintainer of the widely used curl tool found that only one of five AI-reported “confirmed” bugs was a valid CVE. So the flood includes noise as well as signal.
Why We Call It Good News, With a Condition
Here is our reading, and it is ours and not FIRST’s. A flaw that is found is a flaw that can be fixed. If the same hidden flaws exist whether or not anyone finds them, then an AI that finds more of them, and finds them in code that already existed, is giving defenders information they did not have before. We think of that as a visibility dividend.
FIRST does not claim defenders are winning. Its blog describes a race between AI-accelerated exploit development and AI-accelerated patch generation, and says the current advantage may not last long and should be seized. That is the condition.
The dividend only pays if you can act on what is found, quickly, on the right things.
The dividend only pays if you can act on what is found, quickly, on the right things. A company that cannot tell which of its systems matter will drown in a flood that a prepared company treats as weather.
FIRST adds a pointed warning for anyone tempted to read quiet as safe: when published vulnerabilities drop or processing is delayed, it says, you are often seeing reduced human headcount and not a safer internet.
The Number That Has Not Moved
Here is the most useful finding for a CEO. FIRST built a filter for the flaws that actually demand action: those listed in the Known Exploited Vulnerabilities catalog kept by the US cybersecurity agency CISA (1,587 entries as of May 1, 2026), or those with an EPSS score above 10 percent, meaning a meaningful estimated chance of being exploited soon (EPSS scored 329,934 CVEs as of that date). Under that filter, FIRST says, the actionable patching burden remains flat. The flood of discovered flaws is up sharply; the pile of flaws that need action this week is not.
The practical guidance follows from that. FIRST recommends adopting exploitability overlays immediately, calls EPSS and the CISA catalog the most effective triage tools, and says patching on live systems should stay steady at least through the end of 2026. It also tells software makers and open source maintainers to plan for roughly double the patching workload, which matters to you in a different way: expect your vendors to ship more fixes per release, and ask how they will help you absorb them. And it advises budgeting to the growth of your software estate and not to the CVE count.
FIRST gives no figure for what share of all CVEs are ever exploited, so we will not either. The point is the filter, not the percentage.
A Test Case From This Week
The news cycle supplied an example while we were writing. On October 21, 2026, the PHP project released fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which security vendors have nicknamed php2shell. PHP’s advisory rates both 9.2 on the severity scale, describes them as remote code execution that an unauthenticated request can trigger, cites a demonstrated exploit, and says updating is the only safe choice. Fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with older versions no longer supported. Researchers at several firms reportedly found it with AI tools in August and reported it privately, so patches existed on the day of disclosure.
Read the headline numbers with care. Wiz, a security vendor, says the flaws affect 70 percent of the internet; its page gives no basis for the figure and does not separate how much of the web runs PHP from how much is vulnerable. Palo Alto Networks’ Unit 42 counts more than 22.6 million potentially vulnerable instances from its own telemetry, without explaining how it decided they were vulnerable. Cloudflare has reportedly seen exploit attempts within hours, according to press coverage we could not trace to the source, and exploit attempts are not compromises. This is fast-moving, so check the latest before you act.
What does hold up is the lesson. This flaw clears any sensible filter without help from the total CVE count: it can be triggered from the internet, no login is required, a working exploit exists, and the affected software runs a great many websites, including common content management systems. The question for a CEO is not whether PHP is scary. It is whether anyone owns the answer to “do we run it, who patches it, and by when.” If your website runs on WordPress or a similar platform, that question has a name on it: your web host or your agency.
The Method to Insist On
A prioritization method does not need a security team. It needs five things, and a mid-market company can have them in a month.
First, an inventory of what you run, starting with anything reachable from the internet. You cannot rank flaws in systems you have not listed, and the list should include AI tools and agents; FIRST warns that fast-built, short-lived AI-generated software can carry small vulnerabilities that national databases do not track. We covered that ground in Less than a Third of AI Agents are Governed.
Second, a written rule for what jumps the line. A sound starting rule is FIRST’s: anything on the CISA known-exploited list or scoring above 10 percent on EPSS, on a system that matters to the business, comes first. Third, time targets by tier, so that known-exploited flaws on internet-facing systems get days and everything else gets a longer, written window. The targets are our recommendation and not a standard; set them with your technology leader.
Fourth, a named owner and a short weekly review. Two numbers are enough: how many must-fix items are open, and how old the oldest one is. If you already run a weekly leadership meeting, including tech in the weekly meeting shows where those two numbers fit. Fifth, a signed exceptions path: when a fix cannot happen on time, a person accepts the risk in writing and names the workaround. We expect boards, auditors, and regulators to ask for exactly that kind of evidence; we looked at the SEC’s rising expectations in The SEC Formally Raises the Cybersecurity Bar for Public Companies.
What This Will Not Do
A filter will not catch everything. EPSS is a probability and not a prediction, the known-exploited list only names flaws that someone has already seen exploited, and a brand-new flaw can be dangerous before it appears on either. Prioritizing is also not patching: the method makes sure the right work comes first, and someone still has to do it. And the evidence has limits we want you to see. The forecast is a model with wide intervals, the totals include housekeeping, FIRST has not said how much of the rise comes from AI versus software growth, several sources here are vendors or news summaries of FIRST’s report, and the PHP figures were still being worked out at the time of writing.
Three Questions for Monday
Ask your technology leader three things. Which of our systems face the internet, and who patches each one? What is our rule for which fixes go first, and when did we last check it against a known-exploited list? How many must-fix items are open today, and how old is the oldest? If the answers take more than an hour to assemble, you do not yet have the method, and the flood will feel like a flood. If you want an outside read, our cybersecurity consulting and independent assessment start with exactly these questions, and our bench of more than 450 former CIOs, CTOs, and CISOs includes people who have run security programs at mid-market companies.
The number of flaws was always going to grow. What you can control is whether you are the company that reads it correctly.
The number of flaws was always going to grow. What you can control is whether you are the company that reads it correctly.
