VULNpocalypse

What is the Vulnpocalypse?

A plain-English definition, the argument behind it, and the five habits that matter most for people who write and ship code.

By ARPSyndicate Research · Updated

The short definition

Finding bugs used to be the slow, expensive part of security. Frontier AI models made it fast and cheap: Anthropic puts the compute cost of a vulnerability found through Project Glasswing at under $50 (Software Improvement Group). The rest of the pipeline did not speed up. Triage, writing a fix, releasing it, and getting every user to deploy it still take people and time.

The Vulnpocalypse is the gap between those two speeds. As the Cloud Security Alliance put it, it is the point where AI finds zero-days and writes exploits faster than defenders can patch (CSA).

Where the word came from

The word circulated among security practitioners from about October 2025 and went public in the week of 7 April 2026, when Anthropic announced Claude Mythos Preview and Project Glasswing. NBC News, The Register, Axios and TechCrunch have all used it since, and Wiktionary lists it as a 2026 neologism. Nobody has a credible claim to have coined it. The dated story is on our timeline.

Is it real or hype?

Both camps have data, and the honest answer depends on which number you look at.

The volume is real. By 23 October 2026, 86,292 CVEs had been published that year, 2.2 times the same period of 2025 (CyberHire). Vendors are shipping record patch batches. NIST stopped enriching most new CVEs in the NVD because it could not keep up (Help Net Security).

Exploitation is not growing at the same rate. Google’s threat intelligence group found that only 0.23% of 2026 CVEs had been seen exploited by August (Google Cloud). Root Evidence’s “Vulnpocalypse Report” argues the surge “isn’t showing up in the data” on confirmed exploitation (BusinessWire). Sceptics call the feared outcome the “Breachpocalypse” and say it has not arrived yet.

But the bugs that do get exploited get exploited fast. VulnCheck found 23% of exploited CVEs in the first half of 2026 were hit on or before the day they were published (VulnCheck), and Mandiant estimates the 2025 mean time-to-exploit at about seven days before a patch existed (Google Cloud).

Put together: the Vulnpocalypse is a volume problem, and your risk is an exposure problem. You cannot patch everything, and you no longer need to pretend you can. You need to know quickly which few issues are reachable in what you actually run.

What it is not

  • Not the 2025 CVE funding scare. In April 2025 MITRE’s CVE contract nearly lapsed. CISA extended it, and that episode is not what people mean by the word.
  • Not a single bug. Log4Shell (2021) and PHP2Shell (2026) are individual vulnerabilities. The Vulnpocalypse is the rate at which bugs like them are now being found.
  • Not only about CVEs. In early 2026 an attacker using commercial AI models took over more than 600 FortiGate firewalls with exposed admin ports and reused passwords, with no vulnerability involved (AWS). AI speeds up attackers as well as bug finders.

What it means for developers

  1. Your dependencies will ship security fixes more often. If upgrading a library takes a sprint, you will fall behind. Automate patch-level updates behind tests, with Renovate or Dependabot, so a security release reaches production in days rather than months.
  2. “No CVE” no longer means “no bug”. Many AI-found issues are fixed as ordinary commits before, or without, a CVE. Track upstream releases, not only advisories.
  3. Don’t rely on NVD severity alone. Since 15 April 2026 most new CVEs get no NIST score. Use ecosystem advisory databases such as OSV.dev and the GitHub Advisory Database, and add exploitation signals: CISA’s Known Exploited Vulnerabilities list and EPSS. See our NVD advisory.
  4. Treat install scripts and CI as attack surface. The fastest-spreading 2025 to 2026 attacks were supply-chain worms that ran at npm install and stole tokens. See our Shai-Hulud advisory.
  5. Know what you expose. A critical bug in a library you don’t load is noise. The same bug in an internet-facing PHP app is an incident. Inventory what is reachable from the internet before the next PHP2Shell, not during it.

How the Vulnpocalypse differs from Patchmageddon

“Patchmageddon” is J.P. Morgan’s word (Michael Cembalest, July 2026) for the same phenomenon, seen from the patching side (J.P. Morgan). “Vulnpocalypse” is the more common term among practitioners and in the press. “Slopdemic”, Casey Ellis’s word, describes the flood of low-quality AI-generated bug reports reaching maintainers.

Frequently asked questions

What does Vulnpocalypse mean?

It is a blend of “vulnerability” and “apocalypse”. It names the surge in AI-discovered software vulnerabilities since April 2026, which arrive faster than they can be fixed and patched.

When did the Vulnpocalypse start?

It went public on 7 April 2026, when Anthropic announced Claude Mythos Preview and Project Glasswing. The term circulated informally from about October 2025, and the pressure behind it dates back to the NVD backlog of February 2024.

Is the Vulnpocalypse real?

The surge in discovered vulnerabilities is real: 2026 CVE volume was more than double 2025’s by October. Confirmed exploitation has risen much more slowly, so the practical problem is prioritisation, not the end of the internet.

What should developers do about the Vulnpocalypse?

Automate dependency updates, stop relying on NVD severity scores alone, watch the CISA KEV list and EPSS for exploitation signals, lock down install scripts and CI tokens, and know which of your services are reachable from the internet.

Who coined the term Vulnpocalypse?

Nobody is credibly credited. The Cloud Security Alliance’s chief analyst wrote in April 2026 that he did not know who coined it, and that it had been in informal use for about six months.