Summary
Rapid7 reported that high- and critical-severity vulnerability disclosures doubled year on year to 8,539 in Q2 2026, while newly exploited vulnerabilities rose 8% to 40. The analysis links the pressure to AI-assisted discovery and exploitation, as well as insecure code produced through vibe coding, and recommends prioritising exposure over severity scores alone.
Why it matters
Security and development teams need exposure-aware triage and continuous controls around AI-generated code rather than relying only on periodic, severity-based remediation.
Related coverage
- Researchers show how Copilot can be induced to expose connected data
- CISA orders urgent remediation for actively exploited Ray RCE flaw
- ValidateHTML finds pervasive markup and accessibility failures across top domains