Talos says AI bug mining is flooding Microsoft Patch Tuesday
Original title: There's only so much code: the rise in vulnerability numbers
This month's 1,415 Microsoft advisories far exceed a pre-June average near 100, while exploited bugs rose more slowly.
Cisco Talos says frontier models, particularly Mythos, are finding old bugs in widely used libraries and pushing Microsoft Patch Tuesday from a pre-June average of about 100 advisories a month to 975 in September and 1,415 this month. Talos says CVEs rose 105% year over year while Known Exploited Vulnerabilities rose 37%, and only 3 of September's 975 Microsoft advisories were exploited in the wild. The post questions the traditional 90-day disclosure window and urges prioritization, interim mitigations such as LiveProtect, behavioral detection, and AI checks in build pipelines.
Unconfirmed: Whether discoveries will plateau after the legacy backlog is fixed is Talos's hypothesis, not a measured result.
- Talos cites log4j, CVE-2021-44228, as an earlier ubiquitous-library failure.
- Open-source maintainers are described as flooded by the discovery pace.
- Format-string discoveries peaked in 2005 after emerging as a bug class in 2000.
- Talos says MAPP notifications now arrive faster and on staggered timelines.
- 1.Prioritize high-exploitability flaws and use interim mitigations such as LiveProtect.
- 2.Add behavioral anomaly detection and AI evaluation to software build chains.
- Vendors
- Microsoft
- Organizations
- Cisco Talos
- AI models
- Mythos
From the original article
7 min read at blog.talosintelligence.com
The September Microsoft Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering.
By Kri Dontje · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.