Patch Less
More bugs, found faster # In 2025, 48,185 CVEs were published, about 21% more than in 2024. That’s roughly 130 a day, with a clear preference for Tuesdays. Not all of them are your problem. The biggest single source was a company that reports WordPress plugin bugs, and I’m fairly sure nobody runs WordPress on their CEO’s laptop.1
The direction matters more than the number, and AI is pushing it from both ends. Google’s Big Sleep agent reported its first 20 vulnerabilities in August 2025, mostly in FFmpeg and ImageMagick. Those aren’t exotic projects. They sit inside a lot of desktop software your users run every day. On the other end, Mandiant’s M-Trends 2026 estimates the mean time to exploit at minus seven days. On average, exploitation now starts before the patch exists. And according to the Verizon 2026 DBIR, organisations took a median of 43 days to fix vulnerabilities, up from 32 the year before.