AI-accelerated vulnerability disclosures overwhelm defenders
A cluster of critical flaws and breaches landed within about 48 hours, and some attribution and provenance claims remain disputed.
World#08
15k
Monthly CVEs reportedly up from 4k
Image: Latent Space
15kMonthly CVEs reportedly up from 4k
The short version
- Over roughly 48 hours, a cluster of critical disclosures and breaches landed together.
- GitLab disclosed a CVSS 10 flaw affecting releases since 2014, and PHP2Shell is an unauthenticated RCE in PHP.
- LiteLLM 1.107.0 shipped with a password stealer, and Zeabur is shutting down after 321,810 accounts were breached.
- Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, which used the ARTEX agentic pentest framework against 2,250+ Microsoft 365 tenants.
Why it matters
The wave is being read as a test of whether defenders can keep pace with AI-driven discovery. Reports disagree on whether this shows offense winning or a defensive audit, and Joshua Achiam reportedly said only about 4 of roughly 16 major incidents occurred this week. For developers, the LiteLLM and Railway items call for checking secrets and dependencies now, and Python users are advised to update pip, uv, certifi and system CA stores.
“are going to get a lot worse before they get better.”