Security1 publisher2 min readPublished
Exploitation of software flaws tops Verizon's 2026 intrusion list, up 31% year over year
An SC Media commentary builds its case from Verizon's 2026 breach data, JPMorgan's patch arithmetic and Endor Labs dependency counts. Every figure reaches operators secondhand, and the ratio of disclosed to patched is the one that survives the discount.
The Watch · Security desk
What happened
- Verizon's 2026 Data Breach Investigations Report puts exploitation of software vulnerabilities at the top of the list of ways attackers get in, up 31% year over year, while credential-based attacks declined.
- J.P. Morgan's Michael Cembalest, in a July 2026 Eye on the Market note drawing on the bank's Patchmageddon research, counted roughly 48,000 vulnerabilities disclosed in 2025 and roughly 7,500 patched.
- Research into flaws discovered by AI, including Anthropic's Mythos, found that the overwhelming majority of them carried no public advisory at all.
- Sonatype counted more than 450,000 malicious open-source packages in 2025, a great many published through legitimate maintainer accounts that had been quietly taken over.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Maintenance windows blocked out a quarter ahead cannot be sized against a one-day median, so patch scheduling no longer works as the control most vulnerability programs were built to operate.
- exposure An environment whose coverage is defined by NVD and KEV matching is blind by construction to any flaw found without an advisory being filed, and the scanner will still report clean.
- decision Security budgets now face a split between more scoring of catalogue entries and the deployment inventory work that shows which affected builds are actually running and reachable.
- precedent Signed artifacts and clean manifests will keep clearing admission gates until something inspects the deployed binary itself, because both checks pass on code that has already been tampered with.
The loop the column describes begins with the vendor's own advisory. A model reads the patch, works backward to the flaw it fixes, and produces a functioning exploit, with no human anywhere in the attacker's chain [7]. The column states the mechanism plainly: the remediation itself now tells the attacker what to build [8].
The patch arithmetic is where the argument holds up best. Roughly 48,000 disclosed against roughly 7,500 patched leaves about 40,500 vulnerabilities from 2025 carrying no fix, and puts the patched share at 15.6% [16]. A quarterly maintenance window was defensible against a median exploitation gap that ran close to a year in 2021. At about one day, that gap has compressed by a factor of roughly 365 since 2021 [17]. Getting to a single minute means dividing the remaining day by another 1,440 [18]. Cembalest's minute is an expectation, built from that arithmetic rather than measured directly [6].
The coverage problem is separate from the speed problem. A scan-and-patch program matches deployed components against the NVD and similar public feeds, so its coverage is bounded by what has been catalogued rather than by what is running [10]. Teams organised around the CVE, the CVSS score, KEV inclusion and the resulting patch window are working that same catalogue [21].
A signature records who vouched for an artifact. It says nothing about what the artifact does. The SolarWinds Orion update was signed, its provenance checked out, and it walked into thousands of environments backdoored [11].
Endor Labs put roughly 95% of open-source vulnerabilities in transitive dependencies that most manifests never surface [13]. On the column's reading, SAST and composition tools are genuinely useful to developers and genuinely blind as a deployment control [14].
All of this arrives secondhand, through an SC Media Perspectives column written by a community contributor [19]. The DBIR method behind the 31% is not shown, and neither is the sample behind the Patchmageddon median. What the numbers do support is narrow and testable in your own environment: a severity score out of 10 does not report whether the affected build is deployed and reachable, and that is the question the column says attackers answer first [15][20].
What to watch
- Whether Verizon publishes the method behind the 31% rise, and whether the reported credential decline is a definitional change in the 2026 DBIR.
- Whether J.P. Morgan's Patchmageddon research publishes the sample behind the one-day median exploitation gap.
- Whether NVD or KEV begin carrying AI-discovered flaws that arrive with no vendor advisory attached.