Critical CVE disclosures at 21 major vendors jump from 84 a month to 606

Twenty-one of the largest software vendors on earth disclosed 606 critical-severity CVEs in July 2026. In the four years before this spring, that number never once cleared 100 in a month, and its previous record was 84. Counting high-severity bugs alongside critical ones, the same group published roughly 2,500 disclosures in July — about 5× the monthly record set before Anthropic announced Claude Mythos Preview, and 60% above June's own record. The data comes from Epoch AI, which tracks cve.org filings from a fixed list of 21 notable organizations — Microsoft, Google, Apple, AWS, Adobe, Oracle, Cisco, IBM, Red Hat, Intel, AMD, NVIDIA, Qualcomm, Samsung, SAP, VMware, GitHub, Linux, Mozilla, Apache and OpenSSL — precisely so the count is not polluted by noisier reporters.

Monthly high- and critical-severity CVEs from 21 notable organizations. Credit: Epoch AI (CC-BY).

The inflection lines up with April 2026, when Anthropic said Claude Mythos Preview could autonomously discover and exploit software vulnerabilities and that Project Glasswing partners — Microsoft, Google, Apple and AWS among them — had been running it against their own code before release. Glasswing alone claims to have found more than 10,000 high- or critical-severity vulnerabilities, many still undisclosed; OpenAI has a parallel effort. Epoch is careful about causality: some of the jump is genuinely easier discovery, some of it may simply be more people looking, and severity ratings get revised after publication — a revision that already moved the pre-Mythos combined record from roughly 440 to roughly 490.

#The exploit window

The disclosure curve reached a wider audience through a16z's Charts of the Week, where Moses Sternstein paired it with data from the Zero Day Clock, Sergej Epp's public exploitation tracker. On the clock's reading as of September 1, the Zero-Day Rate — the share of exploited CVEs attacked on or before the day of disclosure — had climbed from 18.7% in 2018 and 22.8% in 2020 to 86.7% in 2026, a jump of about 62% from 2025's 53.6% alone.

Credit: a16z Charts of the Week, source Zerodayclock.com.

The companion "Exploit Survival Curve" is the one practitioners keep quoting. Of CVEs that will eventually be exploited, roughly half of the 2022 cohort was still unexploited three months after disclosure. The 2026 cohort falls to near zero inside the standard 30-day patch window.

Credit: a16z Charts of the Week, source Zerodayclock.com.

#The headline metric was retired two days later

Sternstein's most-quoted line — a median time-to-exploit of one day, "projected to reach 1 minute sometime next year" — describes a metric the Zero Day Clock no longer publishes. Two days after the newsletter went out, Chris Hughes documented the project's rebuild: the clock is gone, replaced by an observatory that explicitly refuses to publish a time-to-exploit number. Its own reasoning is that the metric ignores aging (recent CVEs look fast because the slow ones have not been exploited yet), saturates once exploitation happens on or before disclosure day, and cannot distinguish attackers moving earlier from a growing tail of years-old bugs being hit.

What the rebuilt site publishes instead is two counts, never one ratio: in the first half of 2026, 35,853 vulnerabilities published, 484 newly named as exploited, and 133 of those already under exploitation when they went public. Through eight months, 57,884 published and 674 KEV listings, against 479 for all of 2025 and 48 in 2021.

#Why it matters

The two datasets point at the same asymmetry from opposite ends. Discovery has been automated and the disclosure count reflects it; remediation capacity has not moved. Hughes cites Anthropic research in which Mythos Preview produced a working exploit against a Firefox patch within an hour of Mozilla shipping it, and eight full exploit chains in about twelve hours — while a Windows patch typically takes seven days to reach 90% of enrolled devices. The honest read of the a16z charts is not that exploitation now takes a minute; it is that the one number everyone wanted to quote turned out to be unmeasurable, and the counts that replaced it are still going up.