VulnCheck findings reported on October 25 say AI systems are now uncovering software flaws at twice last year's pace — and the 90-day disclosure clock that governed cybersecurity for a generation is collapsing under the speed of the machines.
The most consequential number in cybersecurity this autumn is a doubling. Findings published by VulnCheck, and corroborated by global security specialists in an industry summary reported on October 25, 2026, indicate that software vulnerabilities uncovered by advanced AI systems have doubled year-on-year — in plain terms, AI discovered vulnerabilities double the previous year's total — and that the surge is already driving severe disruption across government networks and critical infrastructure. That figure is VulnCheck's, reported rather than independently verified by this newsroom, and it should be read with that attribution attached. But even allowing for the imprecision of any single vendor's count, the direction of travel is not seriously disputed by the specialists cited alongside it: automated code auditing has crossed a threshold at which the limiting factor in vulnerability discovery is no longer human attention. It is compute.
What the VulnCheck findings actually say
The reporting, summarised on October 25, 2026, describes a step-change rather than a trend line. For two decades, the population of known vulnerabilities grew roughly in step with the population of human researchers looking for them — a slow, artisanal process in which a skilled auditor might spend weeks inside a single codebase. Large language models and specialised auditing agents have industrialised that work. An AI system can read millions of lines of code, trace data flows across components no single reviewer would hold in memory at once, and test hypotheses about unsafe behaviour at a pace no human team can match. VulnCheck's reported doubling is the statistical shadow of that industrialisation. The same reporting stresses the downstream effect: disruption across government networks and infrastructure, as defenders confront a queue of serious flaws that grows faster than their patching capacity. A doubling of discovery against a flat patching workforce is not a doubling of risk in any simple sense — many machine-found flaws will be minor or unreachable — but the serious tail of the distribution grows with the total, and it is the tail that closes hospitals, grounds services and empties incident-response teams of their weekends.
A week that showed the strain
The abstract argument became concrete in the same news cycle. Help Net Security's week in review, published October 25, 2026, noted that PHP — the language still running a large share of the world's websites — released critical security patches on October 21, 2026 addressing two vulnerabilities each rated 9.2 under CVSS v4.0, a severity band reserved for flaws that are remotely exploitable with severe impact. The same roundup recorded that a Palo Alto Networks GlobalProtect VPN flaw was being exploited in active attacks — not theorised about, not proof-of-concepted, but used. Put those three items side by side and the week's real story emerges. The defenders' calendar is now set by other people's machines: a critical patch here, an in-the-wild VPN exploit there, each demanding emergency change windows inside organisations that planned their maintenance months ago. For context, our coverage of the industrial scale of AI-era security spending — the $255 million AI cybersecurity push associated with Mandia — shows how much capital is already chasing this problem, and our reporting on the eMudhra weak certificate keys case before CERT-In and the Chrome root programme shows how a single cryptographic weakness can ripple through the trust infrastructure every browser depends on. Discovery, exploitation and trust failure are no longer separate beats. They are one system under accelerating load.
The 90-day rule meets machine speed
The policy consequence, as the October 25 reporting frames it, is that sovereign cybersecurity agencies — including the US Cybersecurity and Infrastructure Security Agency (CISA) and its international counterparts — are being forced to rethink vulnerability disclosure itself. The traditional paradigm granted a vendor roughly 90 days of quiet, responsible disclosure before a flaw was made public: long enough to build and ship a fix, short enough to concentrate minds. That bargain rested on an assumption that has now failed — that during the quiet period, the flaw stays quiet. When malicious tools can discover and exploit the same vulnerability independently within hours, secrecy stops being a shield and becomes an information asymmetry that favours whoever finds the bug second and says nothing. A 90-day embargo in a world of hour-scale rediscovery does not protect users; it merely guarantees that the attacker who rediscovers the flaw on day three operates unopposed until day ninety. That is the core of the reform case now pressing on CISA and its counterparts: disclosure timelines designed for human-speed discovery cannot survive machine-speed rediscovery.
Two honest arguments, one operational tension
It would be a mistake to treat the defenders of the old timelines as nostalgic. Their argument is operational, not sentimental: instant publication arms attackers before patches propagate. Enterprise estates cannot patch at machine speed. A hospital network, a water utility or a government department must test fixes against fragile legacy systems, schedule downtime and roll changes through estates measured in tens of thousands of endpoints. Publish a flaw the hour it is found, and you hand a weapon to every opportunistic attacker while the patch is still in change review. The reformers answer that this assumes a secrecy that no longer exists: when both sides' machines find the same bug within hours, the embargo protects the vendor's reputation more than the user's network, and coordinated-but-fast disclosure with mitigations published immediately serves defenders better. Between those positions sits the real operational tension the reporting identifies — patching speed against outage risk. Rushed remediation breaks production systems; slow remediation leaves known holes open. Every chief information security officer now lives inside that trade-off daily, and AI-driven discovery has tightened it from both ends at once.
A separate story, the same technology wave
One clarification matters for readers following this site's coverage. This global disclosure story is separate from the Japan cyber-simulation case involving PHP flaws that Signal Post News covered separately. The two stories involve overlapping technology — the same language ecosystem, the same week, the same underlying shift in how flaws are found — but they are different events with different actors and different facts, and they should not be merged. The VulnCheck findings concern the worldwide volume of AI-discovered vulnerabilities and the disclosure regimes struggling to contain them. The Japan case was a specific national exercise with its own circumstances. Conflating them would flatter neither story's accuracy.
Why this matters
The deeper significance of the reported doubling is not the number itself but what it does to the economics of defence. Cybersecurity's old equilibrium rested on scarcity: flaws were rare enough that each could be individually triaged, embargoed, patched and disclosed in an orderly liturgy. AI discovery abolishes that scarcity. When findings arrive as a flood rather than a trickle, every downstream institution built for the trickle — vendor patch cycles, agency advisories, compliance calendars, insurance underwriting — deforms under the volume. The prescriptions in the October 25 reporting follow logically from that diagnosis: mandatory memory-safe programming languages, so that entire classes of flaw are eliminated at the source rather than hunted one by one; aggressive isolation of legacy systems from public routing, so that the unpatchable estate is at least unreachable; and sovereign security standards that continuously evaluate algorithmic offensive threats, treating machine attackers as a standing condition rather than an emergency. Each prescription is an admission that the perimeter-and-patch model is finished. Memory-safe languages concede that humans and their AI assistants will keep writing flawed code in unsafe ones. Isolation concedes that some systems will never be fixed. Continuous evaluation concedes that the threat is no longer episodic. Until defensive architecture reaches parity with the velocity of AI-driven code auditing, the reporting concludes, AI-discovered vulnerabilities will keep destabilising digital ecosystems — and on the evidence of this week, parity is not close.
What happens next
Watch three things. First, whether CISA and its international counterparts formally shorten or tier disclosure expectations — even an unofficial signal that 90 days is no longer the default would reset vendor behaviour worldwide. Second, whether the PHP patches of October 21 and the actively exploited GlobalProtect flaw produce the familiar post-disclosure exploitation wave; if exploitation now routinely precedes disclosure, the reformers' argument becomes very hard to answer. Third, whether memory-safe mandates move from recommendation to procurement condition, because governments buy enough software to change what vendors build. The doubling VulnCheck reports is, in the end, a measurement of two races at once: machines finding flaws, and institutions deciding how fast they are willing to change. The first race is already decided. The second is the story of the next year.