AI is finding software flaws faster than organizations can fix them, and attackers are keeping pace.

The US National Vulnerability Database logged 45,207 flaws by late July 2026, nearly matching all of record-setting 2025.

Vendors show the same jump: Google fixed 433 Chrome bugs in one July update versus 11 a year earlier, and Oracle patched 1,449 against 309.

This week’s PHP emergency showed the result, as banks, airlines and governments pulled sites offline over 2 AI-found flaws.

Exploited flaws haven’t risen yet, largely because companies find most bugs themselves, as Google did with 401 of its 433.

Palo Alto Networks’ Unit 42 estimates that more than a third of 22M internet-exposed systems vulnerable to the PHP flaws run software that can’t be patched, and expects upgrades to take months.