There's only so much code: the rise in vulnerability numbers

Cisco Talos reports that Microsoft's October 2026 Patch Tuesday included 1,415 vulnerability advisories, up from 975 in September and roughly tenfold the pre-June monthly average of around 100. Talos attributes the spike to frontier AI models, particularly Mythos, which are efficiently excavating years of technical debt in widely used legacy libraries and tools, straining open-source maintainers and challenging the traditional 90-day coordinated disclosure timeline. Despite a 105% year-over-year jump in published CVEs, the number of vulnerabilities added to the Known Exploited Vulnerabilities (KEV) list grew only 37%, and just three of September's 975 Microsoft advisories were actually exploited in the wild—suggesting most newly found bugs aren't practically weaponized yet. Talos advises organizations to prioritize flaws with real exploitability in their own environment, deploy interim mitigations such as LiveProtect, add behavioral anomaly detection, and fold current AI evaluation tools into software development pipelines as defense-in-depth measures.