AI is finding software flaws faster than organizations can fix them, and attackers are keeping pace.

> The US National Vulnerability Database logged 45,207 flaws by late July 2026, nearly matching all of record-setting 2025.

> Vendors show the same jump: Google fixed 433 Chrome bugs in one July update versus 11 a year earlier, and Oracle patched 1,449 against 309.

> This week’s PHP emergency showed the result, as banks, airlines and governments pulled sites offline over 2 AI-found flaws.

> Exploited flaws haven’t risen yet, largely because companies find most bugs themselves, as Google did with 401 of its 433.

> Palo Alto Networks’ Unit 42 estimates that more than a third of 22M internet-exposed systems vulnerable to the PHP flaws run software that can’t be patched, and expects upgrades to take months.