CISA KEV now lists most new flaws within a week: the typical 2026 CVE was added 4 days after it went public, against 24 days for 2022 CVEs.

Why are vulnerabilities being exploited so much faster than before?

Two structural forces are compressing the time to exploit: AI-assisted analysis and a broader pool of actors who can use it. The Cloud Security Alliance AI Safety Initiative found that AI systems can now generate working proof-of-concept exploit code for published CVEs in as little as 10 to 15 minutes at a cost of approximately one dollar per attempt, and that the CVE-Genie multi-agent framework reproduced 51% of all CVEs published in 2024 and 2025 at an average cost of $2.77 per CVE.³

AWS Security Blog describes the same shift from the defender's side: "The time from patch to working exploit is shrinking for structural reasons. In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them. That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit."¹ PHP2Shell illustrated this directly: Amazon Threat Intelligence detected exploitation attempts against its MadPot honeypot as early as Oct 17, four days before public disclosure, and multiple proof-of-concept exploits appeared within hours of the patch release on Oct 21.^{1, 5}

What are the latest vulnerabilities and exploits expected to emerge in 2026?

PHP2Shell (CVE-2026-109618 and CVE-2026-109619), disclosed Oct 21, is the most prominent new vulnerability of the month. Both flaws carry a CVSS score of 9.2 and affect every PHP release from version 5.4 onward, allowing unauthenticated remote code execution and memory disclosure independent of the application running on top of PHP.^{5, 6} Cloudflare noted that PHP is used by almost 70% of websites, and that the flaws could affect widely used platforms such as WordPress and Magento.⁴

Earlier in October, CISA added an Ivanti Connect Secure authentication-bypass vulnerability on Oct 13 and a BeyondTrust Remote Support vulnerability on Oct 16.² CISA also added five vulnerabilities on Oct 8, involving Apache Struts, ISC BIND, ProFTPD, ONLYOFFICE Docs, and Strapi, with a federal deadline of Oct 11.² The Linux kernel flaw CVE-2022-0995 was added on Aug 26, 2026, a reminder that old code remains a target: it entered the catalog 1,615 days after its original publication, the longest gap in the chart.

What is the CISA KEV remediation timeline for federal agencies?

The federal remediation timeline changed significantly on June 10, 2026, when CISA issued Binding Operational Directive 26-04, replacing the fixed-deadline model that had governed patch policy since November 2021.² Under the old Binding Operational Directive 22-01, agencies were required to remediate every KEV entry by a fixed due date, with windows typically in the 14-to-21-day range regardless of how the vulnerability was being used.²

BOD 26-04 replaces that uniform clock with a 16-case risk matrix based on four factors: public exposure of the affected system, KEV status, whether the flaw is automatable, and technical impact. According to a research note from the Cloud Security Alliance, a vulnerability that checks all four boxes falls into the highest-risk tier, which carries a three-calendar-day patch deadline.^{2, 3} Security vendor Nozomi Networks has described BOD 26-04 as consolidating and superseding both BOD 22-01 and the earlier BOD 19-02, folding federal vulnerability policy into a single risk-weighted framework.² Depending on the four factors, deadlines are now 3 days, 14 days, 60 days, or the next system upgrade.²

Who gains and who loses when zero days hit the catalog instantly?

When a zero day vulnerability hits the KEV catalog on the day of disclosure, defenders with good detection and patching infrastructure gain a clear, authoritative signal to act immediately, while organizations that rely on fixed patch cycles are exposed from the first moment. The chart shows that 56 of the 193 2026 entries (29%) were listed on the day NVD published the CVE or before it, leaving no buffer at all between public knowledge and confirmed exploitation.

For PHP2Shell, CrowdStrike noted that exploitation leaves virtually no digital traces: "There is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover," and that "worker processes remain stable, responses return HTTP 200, and application logs record no anomalies, because no application code ever ran."⁵ That invisibility widens the gap between organizations with behavioral detection and those relying on application logs or CVE-specific signatures. AWS advises starting investigations from the earliest known exploitation date rather than the disclosure date, and investing in detections that do not rely on a signature for a specific CVE.¹

Will the gap between disclosure and exploitation keep shrinking?

The sources point to continued compression, though they frame it as a structural trend rather than a certainty. The Cloud Security Alliance AI Safety Initiative traced the mean time to exploit from roughly 32 days in 2022 to approximately 5 days for 2023 exploitation activity, and found that by 2025, 32.1% of newly tracked exploits appeared on or before the CVE's public disclosure date, an 8.5-percentage-point increase from 2024.³

AWS Security Blog frames the direction plainly: for critical vulnerabilities in internet-facing systems, it recommends measuring patch and mitigation timelines in hours, because "a 7-day or 30-day SLA assumes a delay that no longer exists."¹ One caveat from the chart itself: the decline is not steady year to year. The medians for the other years in the same collection are 208 days for 2021 CVEs, 6 days for 2023, and 8 days for 2025, so the 4-day 2026 median could still shift as later additions arrive, and the pattern may not move in a straight line.