VULNpocalypse

When did the Vulnpocalypse start?

The short answer is 7 April 2026. The word took off that month, and the numbers behind it have been building since February 2024.

By ARPSyndicate Research · Updated

The Vulnpocalypse

Day 210

Counted from 7 Apr 2026, the day Claude Mythos Preview was announced.

CVEs published since

74,778

April 2026 to today (NVD)

Exploited since

208

bugs added to CISA’s exploited list

Times the word was used

297

public posts since April; almost none before

The Vulnpocalypse in one chart

Three counts on one timeline. Grey bars are before day zero; coloured bars are the Vulnpocalypse. Key events are marked along the top.

THE VULNPOCALYPSE2024-02-12: NVD backlogNVD backlog2024-11-01: Big SleepBig Sleep2025-04-16: CVE contract scareCVE contract scare2025-08-08: AIxCCAIxCC2025-11-21: Shai-Hulud 2.0Shai-Hulud 2.02026-04-07: MythosMythos2026-04-15: NVD stops scoringNVD stops scoring2026-09-30: Record monthRecord month2026-10-21: PHP2ShellPHP2ShellNew CVEs published per month020KNew CVEs published per month, 2024-01: 2,594New CVEs published per month, 2024-02: 2,778New CVEs published per month, 2024-03: 3,309New CVEs published per month, 2024-04: 3,621New CVEs published per month, 2024-05: 4,999New CVEs published per month, 2024-06: 3,078New CVEs published per month, 2024-07: 3,113New CVEs published per month, 2024-08: 2,896New CVEs published per month, 2024-09: 2,514New CVEs published per month, 2024-10: 3,564New CVEs published per month, 2024-11: 4,056New CVEs published per month, 2024-12: 3,431New CVEs published per month, 2025-01: 4,275New CVEs published per month, 2025-02: 3,673New CVEs published per month, 2025-03: 3,998New CVEs published per month, 2025-04: 4,034New CVEs published per month, 2025-05: 3,980New CVEs published per month, 2025-06: 3,681New CVEs published per month, 2025-07: 3,776New CVEs published per month, 2025-08: 3,628New CVEs published per month, 2025-09: 4,321New CVEs published per month, 2025-10: 4,273New CVEs published per month, 2025-11: 3,021New CVEs published per month, 2025-12: 5,491New CVEs published per month, 2026-01: 4,302New CVEs published per month, 2026-02: 4,616New CVEs published per month, 2026-03: 6,234New CVEs published per month, 2026-04: 5,810New CVEs published per month, 2026-05: 6,936New CVEs published per month, 2026-06: 7,942New CVEs published per month, 2026-07: 9,770New CVEs published per month, 2026-08: 12,256New CVEs published per month, 2026-09: 14,933New CVEs published per month, 2026-10: 17,060New CVEs published per month, 2026-11: 71 (month so far)17.1KBugs CISA confirmed under attack, per month050Bugs CISA confirmed under attack, per month, 2024-01: 21Bugs CISA confirmed under attack, per month, 2024-02: 9Bugs CISA confirmed under attack, per month, 2024-03: 10Bugs CISA confirmed under attack, per month, 2024-04: 10Bugs CISA confirmed under attack, per month, 2024-05: 14Bugs CISA confirmed under attack, per month, 2024-06: 9Bugs CISA confirmed under attack, per month, 2024-07: 14Bugs CISA confirmed under attack, per month, 2024-08: 19Bugs CISA confirmed under attack, per month, 2024-09: 25Bugs CISA confirmed under attack, per month, 2024-10: 17Bugs CISA confirmed under attack, per month, 2024-11: 22Bugs CISA confirmed under attack, per month, 2024-12: 16Bugs CISA confirmed under attack, per month, 2025-01: 14Bugs CISA confirmed under attack, per month, 2025-02: 27Bugs CISA confirmed under attack, per month, 2025-03: 32Bugs CISA confirmed under attack, per month, 2025-04: 15Bugs CISA confirmed under attack, per month, 2025-05: 24Bugs CISA confirmed under attack, per month, 2025-06: 20Bugs CISA confirmed under attack, per month, 2025-07: 20Bugs CISA confirmed under attack, per month, 2025-08: 15Bugs CISA confirmed under attack, per month, 2025-09: 16Bugs CISA confirmed under attack, per month, 2025-10: 31Bugs CISA confirmed under attack, per month, 2025-11: 11Bugs CISA confirmed under attack, per month, 2025-12: 20Bugs CISA confirmed under attack, per month, 2026-01: 17Bugs CISA confirmed under attack, per month, 2026-02: 28Bugs CISA confirmed under attack, per month, 2026-03: 26Bugs CISA confirmed under attack, per month, 2026-04: 31Bugs CISA confirmed under attack, per month, 2026-05: 21Bugs CISA confirmed under attack, per month, 2026-06: 23Bugs CISA confirmed under attack, per month, 2026-07: 26Bugs CISA confirmed under attack, per month, 2026-08: 31Bugs CISA confirmed under attack, per month, 2026-09: 43Bugs CISA confirmed under attack, per month, 2026-10: 36Bugs CISA confirmed under attack, per month, 2026-11: 0 (month so far)43Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts)0100Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-01: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-02: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-03: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-04: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-05: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-06: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-07: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-08: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-09: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-10: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-11: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2024-12: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-01: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-02: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-03: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-04: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-05: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-06: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-07: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-08: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-09: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-10: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-11: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2025-12: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-01: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-02: 0Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-03: 2Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-04: 42Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-05: 52Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-06: 27Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-07: 16Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-08: 24Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-09: 37Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-10: 99Uses of the word “vulnpocalypse” (Bluesky and Hacker News posts), 2026-11: 0 (month so far)992024Jul2025Jul2026Jul
Source: NVD (CVEs published, rejected excluded) · CISA KEV · Bluesky and Hacker News searchVULNPOCALYPSE.DEV
How to read it
Each panel has its own scale, so compare shapes, not heights across panels. The shaded area starts on 7 April 2026. The red line marks the two biggest moments: Claude Mythos Preview and PHP2Shell. The last month is only partly counted.
How this is calculated
CVEs published per month come from the NVD API with rejected CVEs excluded. Exploited bugs are CISA KEV additions by the date CISA listed them. Word use is the number of Bluesky posts and Hacker News stories and comments containing “vulnpocalypse” each month. Google Trends shows the same April 2026 start but has no open API.

Every event on one map

Each lane is one kind of event; each numbered dot is one event (click it for details below). Phases run left to right, each as wide as its number of events, with its start date underneath.

AI finds bugsAttacksVulnerability dataThe wordred ring: the two biggest moments
The pressure buildsJan 2024Warning signs pile upOct 2025Day zero7 Apr 2026The data catches up16 Apr 2026The second waveOct 2026AI finds bugsAttacksVulnerability dataThe word1. 2024-02-12: NVD backlog1NVD backlog2. 2024-11-01: Big Sleep2Big Sleep3. 2025-04-16: CVE contract scare3CVE contract scare4. 2025-06-24: XBOW tops HackerOne4XBOW tops HackerOne5. 2025-08-08: AIxCC final5AIxCC final6. 2025-10-01: Word used privately6Word used privately7. 2025-11-21: Shai-Hulud 2.07Shai-Hulud 2.08. 2025-12-03: React2Shell8React2Shell9. 2026-01-21: curl ends bounty9curl ends bounty10. 2026-02-20: 600 FortiGates10600 FortiGates11. 2026-03-05: Domain registered11Domain registered12. 2026-04-07: Mythos + Glasswing12Mythos + Glasswing13. 2026-04-11: NBC uses the word13NBC uses the word14. 2026-04-15: NVD stops scoring14NVD stops scoring15. 2026-05-11: TanStack15TanStack16. 2026-05-14: “It has begun”16“It has begun”17. 2026-05-26: Glasswing count17Glasswing count18. 2026-09-03: Sceptics’ report18Sceptics’ report19. 2026-09-30: Record month19Record month20. 2026-10-02: 8% patched208% patched21. 2026-10-21: PHP2Shell21PHP2Shell22. 2026-10-21: Node.js + LiteLLM22Node.js + LiteLLM23. 2026-10-31: Word peaks23Word peaks
Source: Sources for every event are in the table belowVULNPOCALYPSE.DEV
How to read it
Read left to right through time. Notice how sparse the lanes are before day zero (the red line) and how they fill up after it, and that the word’s own lane is empty until 2026.

All 23 events

#WhenWhat happenedRead
The pressure buildsFeb 2024 to Sep 2025Public vulnerability analysis falls behind, AI starts finding real bugs, and the CVE system wobbles.
1
Vulnerability data		 NVD falls behindNIST slows enrichment of new CVEs. More than 18,000 pile up unanalysed. Source
2
AI finds bugs		 AI finds its first real bugGoogle’s Big Sleep agent finds a stack buffer underflow in SQLite on its own. Source
3
Vulnerability data		 The CVE programme nearly lapsesMITRE’s contract is hours from expiring. CISA extends it by 11 months. Source
4
AI finds bugs		 An AI tops HackerOne’s US leaderboardXBOW, an autonomous pentester, leads the US reputation board for a quarter. Source
5
AI finds bugs		 DARPA AI Cyber Challenge finalAI systems find 54 of 63 planted bugs and 18 real zero-days in 54 million lines of code. Source
Warning signs pile upOct 2025 to 6 Apr 2026Worms hit npm, AI floods maintainers, and security people start using the word privately.
6
The word		 The word circulates privatelyCSA’s chief analyst later says his circle had used it for about six months before April 2026. Source
7
Attacks		 Shai-Hulud 2.0 hits npmA self-replicating worm exposes secrets from more than 25,000 developers in three days. AdvisorySource
8
Attacks		 React2ShellA React Server Components flaw gives remote code execution in Next.js apps. Advisory
9
AI finds bugs		 curl ends its bug bountyToo many AI-generated reports describing bugs that do not exist. AdvisorySource
10
Attacks		 AI-assisted attacker takes 600+ firewallsFortiGate devices in 55 countries fall to exposed admin ports and reused passwords, not CVEs. AdvisorySource
11
The word		 vulnpocalypse.com is registeredA month before the word goes public. The first Bluesky posts using it appear in March. Data
Day zero7 to 15 Apr 2026Claude Mythos Preview and Project Glasswing are announced; the word goes public and NVD stops scoring most CVEs.
12
AI finds bugs		 Claude Mythos Preview and Project GlasswingAnthropic and more than 50 organisations start using the model to find and fix bugs in critical software. Chris Hughes publishes the first article titled “Vulnpocalypse” the same day. AdvisorySource
13
The word		 NBC News uses the wordThe first mainstream use: the so-called “Vulnpocalypse”. Source
14
Vulnerability data		 NVD stops scoring most CVEsNIST moves to risk-based enrichment. Most new CVEs get no NIST severity score. AdvisorySource
The data catches up16 Apr to Sep 2026Patch volumes and CVE counts break records, and sceptics push back.
15
Attacks		 TanStack compromise reaches GitHubA poisoned npm release leads to GitHub’s internal repositories and Grafana. Advisory
16
The word		 “The vulnpocalypse has begun”Palo Alto fixes 75 flaws in a month against a usual five; Mozilla fixes 423 Firefox bugs in April. Source
17
AI finds bugs		 Glasswing’s first count23,019 issues across more than 1,000 open-source projects, 6,202 high or critical. Source
18
The word		 The sceptics’ reportRoot Evidence’s “Vulnpocalypse Report” argues confirmed exploitation is not rising in step. Source
19
Vulnerability data		 14,933 CVEs in one monthSeptember 2026 publishes 3.5 times as many CVEs as September 2025. Source
The second waveOct 2026 onwardPHP2Shell, record CVE months and the busiest month yet for the word.
20
AI finds bugs		 8% of AI-found bugs patchedOf 6,157 Glasswing bugs disclosed to maintainers, 516 are fixed. AdvisorySource
21
Attacks		 PHP2ShellTwo PHP engine flaws give unauthenticated code execution; attacks are reported before the fix ships. AdvisorySource
22
Attacks		 Node.js and LiteLLM in one dayA Node.js release fixes an exploited Brotli bug; LiteLLM ships a poisoned release. Advisory
23
The word		 The word’s busiest month91 Bluesky posts and 8 Hacker News items in October, its highest so far. Data

How often the word “vulnpocalypse” is used

Public Bluesky posts and Hacker News items per month. The first uses appear in March 2026; it takes off in April 2026, the same month Google Trends shows search interest starting.

020406080100Oct 25: 0Oct 25Nov 25: 0Nov 25Dec 25: 0Dec 25Jan 26: 0Jan 26Feb 26: 0Feb 26Mar 26: 2Mar 26Apr 26: 42Apr 26May 26: 52May 26Jun 26: 27Jun 26Jul 26: 16Jul 26Aug 26: 24Aug 26Sep 26: 37Sep 26Oct 26: 99Oct 2699Nov 26: 0Nov 26
Source: Bluesky public search · Hacker News via AlgoliaVULNPOCALYPSE.DEV
How this is calculated
Counts posts, stories and comments containing the exact word, with typo matching off. Bluesky search can miss deleted or private posts, so treat these as a floor.

So which date should you use?

  • For “when did it start”: 7 April 2026. It is the date dictionaries, reporters and search interest all point to.
  • For “how long has this been building”: 12 February 2024, when public vulnerability analysis started falling behind.
  • For “when did it show up in the numbers”: May 2026 for vendor patch volumes, and July to September 2026 for monthly CVE counts.

What it means for your code is in What is the Vulnpocalypse?, and live figures are on the data pages.

Frequently asked questions

When did the Vulnpocalypse start?

Publicly, on 7 April 2026, when Anthropic announced Claude Mythos Preview and Project Glasswing. The word circulated informally from about October 2025, first appeared in public posts in March 2026, and took off in April 2026. The pressure behind it dates back to the NVD backlog that began on 12 February 2024.

Who coined the word Vulnpocalypse?

No one has a credible claim. The Cloud Security Alliance’s chief analyst wrote in April 2026 that he did not know who coined it. The earliest dated public article with the word in its title is Chris Hughes’ Resilient Cyber post of 7 April 2026.

Is the Vulnpocalypse over?

No. CVE publication in 2026 was still running at more than twice the 2025 rate in October, and October 2026 saw PHP2Shell and the busiest month yet for the word.