Record CVEs, PHP emergency, and NIST moves to modernize vulnerability database

The US National Vulnerability Database logged 45,207 flaws by late July 2026, nearly matching the record for all of 2025. Kaspersky's Q2 2026 analysis confirmed CVE registrations hit unprecedented levels that quarter, with AI tools playing a major role in discovering vulnerabilities in third-party software. Patch volumes have tracked the count: Google fixed 433 Chrome bugs in one July update versus 11 a year earlier, and Oracle patched 1,449 against 309. A PHP emergency tied to two AI-discovered flaws forced banks, airlines, and governments to take sites offline; Palo Alto Networks' Unit 42 estimates more than a third of 22 million internet-exposed systems vulnerable to those PHP flaws run software that cannot be patched, with upgrades expected to take months. Figures cited in October 2026 put 3% of all critical software security bugs in recorded history as found in the last month. Kaspersky also found that AI software itself introduces new vulnerability classes, with injection vulnerabilities, once mostly confined to web apps, now broadly relevant due to the rise of AI agents. NIST published a formal Request for Information on August 12, 2026, seeking public input on modernizing the National Vulnerability Database in light of AI, drawing 135 public submissions.