CVE publishing hit nearly 66,000 by mid-September and is still accelerating. Andrey Lukashenkov of Vulners shows what the data says and how to work with it: the patch is your unit of work. Follow Qualys on BrightTALK for more Cyber Risk Series talks: https://www.brighttalk.com/channel/11673 Explore the Qualys Enterprise TruRisk Platform: https://www.qualys.com/etm Build your Risk Operations Center (ROC) today: https://www.qualys.com/roc Andrey Lukashenkov, from the vulnerability intelligence provider Vulners, gives a first-row view of CVE volume in 2026. The median publishing rate was stable through 2025 and into May, then took off in July. He points to record months from the top CVE numbering authorities, better AI-assisted discovery rather than less secure software, AI-assisted bug fixing in the Linux kernel, and a shadow volume of CVE IDs already mentioned in advisories and patches but not yet published. He then shows how to filter the flood: why the NVD backlog grew, why the CISA KEV catalog stayed flat while volume rose, and why scoring models such as EPSS can underrate new vulnerabilities. In practice, remediation comes down to patches. One browser update can close hundreds of CVEs, while one Linux kernel flaw can require fixes across nearly 2,000 downstream packages. He closes on the attacker and defender asymmetry and advises assuming you have a vulnerable internet-facing host. Speaker: Andrey Lukashenkov, Vulners Chapters: 0:00 Intro: a first-row view of CVE volume 0:32 The acceleration: 2026 versus the 2025 baseline 1:33 Five years of CVE volume: nearly 66,000 by mid-September 3:01 Which CNAs are publishing the growth 4:26 Better discovery, not less secure software 6:03 Case study: a browser vendor scales CVE publishing 8:20 Linux kernel: AI-assisted bug fixing 9:59 The shadow volume: CVE IDs not yet published 11:10 How to filter the flood: NVD and its backlog 15:41 Gate one: the CISA KEV catalog 17:55 Why scoring models can underrate new CVEs 20:24 The patch is your unit of work 21:23 Open source: one kernel bug, nearly 2,000 downstream packages 23:01 AI enters the picture: models exploiting vulnerabilities 25:25 The attacker and defender asymmetry 27:38 Assume you have a vulnerable internet-facing host 28:15 Patches exist for nearly all CVEs, and where to find the daily data #CyberRiskSeries #CVE #VulnerabilityManagement #PatchManagement

 89      0