By asahifile 
Fixes are now arriving faster than anyone can review them. Microsoft published 1,461 patches this month, against 1,247 in the whole of 2025. OpenAI says its models have helped internal and external researchers find more than 1,300 bugs in open-source software since May. Google used AI to find and fix 1,072 bugs in Chrome in June alone — more than in the previous two years combined — and has fixed more severe bugs this year than in the previous eight years put together. Node.js has confirmed and fixed 50 vulnerabilities this year, a record, according to the OpenJS Foundation.
The trigger is not a sudden collapse in code quality. It is that models have become extremely good at reading code for defects, and the organisations that build the internet’s plumbing have started pointing them at their own repositories. The New York Times documented the result this week: security teams racing to review and ship fixes before attackers get the same leverage, and an emerging fear that the queue is moving faster than the release process can absorb it. Fouad Matin, who runs OpenAI’s cyber readiness work, spent his birthday on two hours of sleep coordinating a response to two AI-found vulnerabilities affecting a large part of the internet. “AI truly unleashes this Pandora’s box of vulnerabilities,” he told the Times.
The arithmetic that matters
Microsoft’s two numbers are the ones to hold on to, because they convert a mood into a rate. Across twelve months of 2025, 1,247 patches is an average of about 104 a month. October 2026’s 1,461 is roughly 14 times that monthly pace: at October’s rate, Microsoft would cover 2025’s entire annual output in about 26 days.
Now apply that to the people on the receiving end. Patch Tuesday was designed around a predictable monthly rhythm — a triage call, a test window, a deployment slot. Multiply the volume by 14 without adding reviewers, and the only variable left is the time spent per fix. In practice that shows up as shorter regression testing, more changes per maintenance window, and a growing tail of fixes that get applied late or not at all. Chrome’s June figure points the same way: 1,072 fixes in a single month is a product of automated discovery finding things that human review queues never reached.
Where the time actually goes
The PHP2Shell episode — the pair of critical flaws in PHP disclosed on 21 October, which this site covered at the time — works as a worked example of the new pipeline’s shape. Wiz’s researchers said a single researcher, with frontier models and the right tooling, completed in about a week what would previously have taken a world-class team months. The bugs were discovered in late August and disclosed on 21 October: roughly eight weeks from find to public patch, about eight times as long as the hunt itself.
Nothing in those eight weeks was spent looking for more bugs. It went into engineering and coordination: Thai Duong, chief executive of the security firm Calif, said the fix required changes to around 200 files, orchestrated across a private Slack channel and daily calls, with the PHP Foundation, Cloudflare and advance notice to governments. Detection has become cheap, parallel and fast; verification, coordinated disclosure, regression testing and staged rollout have not changed nearly as much. Every organisation that adopts AI bug-hunting inherits the second half of that pipeline whether or not it has staffed for it.
Who should not buy the bug-hunting pitch
The conditions under which this is a clear win are about triage capacity, not model quality — and the pitch decks skip them.
- You should not scale up AI scanning if you cannot triage the output. An unreviewed finding queue is not a security posture; it is a backlog that grows faster than your engineers and eventually gets rubber-stamped. If your team already closes fewer than half its incoming findings, a 14-fold volume increase makes the honest metric — time-to-patch for known-critical issues — worse, not better.
- You should not run it against end-of-life runtimes. The PHP fixes landed for supported branches. A site on an unsupported version gets the advisory, the emergency maintenance window and no vendor patch. Its correct answer is migration planning, not a scanner.
- You should not patch blind. A month with 14 times the normal patch volume implies a rollout cadence most change-management processes were never designed for. Without canary deploys and a rollback path, the outage risk from patching at that speed can exceed the exploit risk for internal, non-internet-facing systems.
- You should aim it at the edge. The reported wins this year came from long-lived, widely deployed code: PHP, Node.js, Chrome. For a small team, the highest-yield target is the handful of dependencies that sit on the internet edge, not the application code you already understand.
What to watch
- Whether Microsoft’s 1,461-patch October becomes the new monthly baseline or a spike, visible in the November and December Patch Tuesday counts.
- Whether the NSA and EU agency advisories around AI-found flaws turn into a formal disclosure norm, including how much notice vendors get before publication.
- Node.js and the OpenJS Foundation’s 2027 numbers: 50 confirmed vulnerabilities in a year is a record, and the trend line matters more than the record itself.
- Whether any of this year’s AI-found flaws shows up in a mass exploitation campaign. Finding is cheap now; the open question is whether attackers get the same leverage.
- Insurance and audit language: expect cyber policies to start asking how many AI-discovered findings are open past their SLA.
Sources: The New York Times, CNN/ABC7.