Explainer
What is a CVE?
A CVE is a public ID number for one known software security flaw, like CVE-2026-12345. It gives everyone the same name for the same flaw.
From a flaw to a fix
- FoundSomeone finds a flaw in software.
- RecordedIt gets a public CVE number.
- PatchedThe maker releases a fix.
- InstalledOnly when people install it is the risk gone.
Headlines count flaws, but what protects you is how many get fixed and installed. Knowing the difference helps you read a scary number without panic or shrugging it off.
Flaw, exploit, patch
- Vulnerability (a flaw): a mistake in software that an attacker could use.
- Exploit: the code or method that actually uses the flaw.
- Patch: the fix from the software’s maker. It does nothing until people install it.
- Zero-day: a flaw attackers use before the maker knows or has a fix. The maker had zero days to prepare.
Why AI changes the numbers
AI can read code at machine speed, so it finds flaws faster, for defenders and for attackers. By one count, about 14,000 new vulnerability records appeared in the first 25 days of October 2026, more than three times all of last October. That is why some called it Black October.
Read the number carefully
A CVE count tells you how many flaws were recorded. It does not tell you how many were fixed, or how many were used in attacks. One analysis reported that only about 1% of AI-discovered vulnerabilities had been exploited so far. Another reported attackers trying a PHP flaw before the public warning. Finding runs at AI speed. Fixing still runs at human speed.
In the news
Our weekly editorial Le Café Noir, October 29, 2026 covers the numbers, with their limits.
Sources
- 1023 Jack: analysis of NVD and CVE.org records
- Infosecurity Magazine: only 1% of AI-discovered vulnerabilities exploited so far (VulnCheck)
- Amazon Threat Intelligence: PHP2Shell exploitation before public disclosure
- Anthropic: coordinated vulnerability disclosure dashboard
Quick answers
What is a CVE?
A CVE is a public ID number for one known software security flaw, such as CVE-2026-12345. It lets everyone talk about the same flaw.
What is a zero-day?
A flaw that attackers use before the maker knows about it or has a fix. The maker has had zero days to fix it.
Why does the number of CVEs matter?
More records can mean more flaws are being found, often with the help of AI. It does not tell you how many are being fixed, or used in attacks. Those are separate numbers.
Get The AI Daily Grind by email, every morning, in simple words.