Cisco Talos said on 20 October that Microsoft's October Patch Tuesday, its monthly fix release, listed 1,415 vulnerabilities. September's had 975, and the average before June was about 100 a month. Talos said most come from old code in widely used products. It said frontier AI models, including Mythos, are better at finding known types of flaws there, not a new type.
Of September's 975, Talos said only three were exploited in the wild. Over a year, known-exploited additions rose 37% while published CVEs, public IDs for flaws, rose 105%. Talos said the two should not grow in proportion, since attackers need only enough useful flaws and can reuse them. It called the danger undeniable: time to exploit is falling fast. It said attackers study vendor patches to find flaws, and AI can remove that slow step. No count of exploited flaws among the 1,415 is given, and whether the surge fades is unknown.
Talos pointed to log4j, a ubiquitous code library few firms had cataloged, which left defenders scrambling to learn if they used it. Leaders can ask: can we list every library we run, and how fast can we patch?