In April I predicted a wave of patches over two to three years, followed by a lower level than before. Half a year later, let\u00b4s look at the numbers.<\/p>\n
This week Microsoft released 1,408 new CVEs in one Patch Tuesday. In all of 2025, Microsoft published 1,244. One month beat the whole of last year. From January to the 10th of October this year, Microsoft published 2,970 CVEs, against 936 in the same period of 2025.<\/p>\n
It is the same across the industry. From January to July, 45,626 CVE records were published in total, two thirds more than in the same months last year. The monthly volume more than doubled between January and July.<\/p>\n
So the wave is real, and steeper than I expected.<\/p>\n
What about exploitation? This is the interesting part. Known exploitation has grown much less than the volume. CISA\u00b4s list of known exploited vulnerabilities grew from 196 to 255 entries over roughly the same period this year. Analysts describe it as bigger haystacks with not that many more needles. That fits my theory: much of the new volume is old bugs that AI can now see, not a sudden wave of new attacks.<\/p>\n
Is there any sign of the downturn yet? Not in the numbers. We are still in phase one, the backlog. But scanning before release is now in production pipelines, and that is what will eventually bend the curve.<\/p>\n
What does it mean for you? Stop measuring your patching against raw CVE counts. Prioritise on exploitation and exposure. Automate everything that can be automated. And plan for Patch Tuesday as a very large event for a while.<\/p>\n
The curve is going up. Make sure your process can climb with it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In April I predicted a wave of patches over two to three years, followed by a lower level than before. Half a year later, let\u00b4s look at the numbers. This week Microsoft released 1,408 new CVEs in one Patch Tuesday. In all of 2025, Microsoft published 1,244. One month beat the whole of last year. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,14,13],"tags":[37,67,195],"class_list":["post-1546","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-security-metrics","category-technology","tag-patching","tag-statistics","tag-vulnerabilities"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1546"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1546\/revisions"}],"predecessor-version":[{"id":1549,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1546\/revisions\/1549"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}