CVE volume nearly tripled from 2018 to 2025 (18k to 49k per year), with the steepest jumps coinciding with the rise of LLMs and agentic coding. More critically, mean time-to-exploit collapsed from 63 days in 2018–2019 to negative values by 2024, meaning attackers now weaponize vulnerabilities before they are publicly disclosed. Zero-days now account for ~70% of exploited bugs, up from 62% in 2021–22. The NVD enrichment backlog exceeded 27,000 unanalyzed CVEs by end of 2025, and NIST abandoned the backlog in April 2026. Malicious open-source packages surpassed 1.35 million cumulative, with AI-assisted exploit generation producing working exploits in 10–15 minutes at under $3 each. The exposure gap between attacker speed and defender remediation time (~55–65 days) has grown to roughly 60 days, explaining why ~60% of breaches involve vulnerabilities for which patches already existed. The post concludes that continuous, autonomous, AI-driven defense is now a necessity rather than an option.
