Here’s how a vulnerability in a popular open-source library plays out in 2026: A maintainer merges a fix and publishes an advisory. Within hours, someone points a model at the diff between the old and new versions and gets a working exploit back. Your scanner flags the CVE the next morning, a ticket gets filed, and the fix is scheduled into next week’s change window. By then the exploit has been circulating for days.

That was a fine enterprise lifestyle choice last year, but it’s considered out of fashion nowadays.

And for good reason, as Michael Cembalest goes over in his “Patchmageddon” report from July 2026, which includes input from J.P. Morgan Asset Management’s cybersecurity leadership. Models such as Anthropic’s Mythos and OpenAI’s GPT–5.5 now find previously unknown vulnerabilities at a scale no human research team can match. Anthropic and its Project Glasswing partners found more than 10,000 new high- and critical-severity zero-days in the first month alone.

At the same time, the exploitation clock shrank. The note puts the median time from disclosure to first exploitation at roughly a year in 2021. Now it’s down to one day in 2026, and projected to be one minute by 2027. Almost 80% of exploitations now land on or before their public disclosure. Models can find vulnerabilities, and hackers can exploit them just as fast, if not faster.

That pressure lands on open source first, because open source is what modern software is made of and because the source is, well, open for all to see.

Source link