Software security flaws are on track to double in 2026, with major firms like Oracle, Microsoft, and Google reporting record patch numbers. While AI tools are significantly accelerating the discovery of these weaknesses, government data shows that actual exploitation attempts have not increased at the same pace.
Detailed Coverage
A significant increase in software security vulnerability disclosures is being recorded in 2026, as the use of artificial intelligence tools accelerates the identification of digital weaknesses. The US National Vulnerabilities Database has logged 45,207 flaws as of July 28, 2026, putting the year on track to record roughly double the total vulnerabilities compared to 2025.
Record Patch Volumes at Major Tech Firms
Large-scale technology companies are managing this surge through frequent software updates. Oracle Corp. issued patches for 1,449 vulnerabilities in its July update, significantly higher than the 309 fixes reported in the same period last year. Similarly, Microsoft Corp. disclosed 642 security bugs in July, nearly five times the number reported a year ago. Alphabet Inc.’s Google also recorded a sharp rise, identifying and resolving 433 vulnerabilities in a recent update to its Chrome browser, compared to 11 in the same update a year prior.
Industry experts note that this trend is driven by the strategic adoption of AI-powered cyber tools. By using internal AI systems, companies are identifying and addressing potential security gaps faster than ever before. For example, internal security teams reported 401 of the 433 vulnerabilities resolved by Google in their recent update, highlighting a shift toward proactive, AI-led internal discovery.
Exploitation Trends and Security Implications
Despite the rapid rise in discovered flaws, there is no verified evidence of a corresponding increase in cyberattacks. The US government’s Known Exploited Vulnerabilities catalog has not shown a rise in exploited issues this year, suggesting that the threat landscape is not necessarily worsening at the same speed as discovery rates. While the high volume of patches requires consistent maintenance by IT departments and businesses to remain secure, many of these vulnerabilities are being found and fixed before they can be misused by external actors.
For investors, this trend highlights a shift in operational focus for major software and cybersecurity companies. Increased investment in AI-driven security infrastructure has become necessary to maintain software integrity. While this may lead to higher research and development costs for technology firms, it also serves as a defensive measure to maintain product reliability. Investors may monitor how these increased maintenance and security costs affect operating margins for major tech providers in the coming quarters, as well as whether these AI capabilities lead to new revenue opportunities in the growing cybersecurity services sector.