New Linux kernel CVEs drop to near zero, poster speculates AI code review
MarkoMarjamaa · reddit · 2026-10-24
A Reddit user tracked fixed Linux kernel CVEs weekly for six weeks, charting vulnerability introduction dates against public disclosure dates.
Key observations:
- Historically 50% of CVEs surface within 2 months and 100% within 3 months, so recent numbers will still grow;
- Yet new CVE introductions dropped sharply around April 20, kept falling after June 15, and only 2 new CVEs appeared after August 10 (both found Sept 26, fixed Sept 28);
- Fixes in the meantime were almost all old holes; a script rerun adding 600 CVEs on Oct 21-22 mostly surfaced old ones too.
The author speculates that new code is now going through some unified AI-powered review before release, stopping vulnerabilities from landing at all — a personal observation, not officially confirmed.
More from Safety
- AI agents are attacking the internet: 2,900 logins a minute across 2,250 orgs — Exponential View (Azeem Azhar) · 2026-10-24
- CISO survey: AI security spend to grow from $9B in 2026 to $65B by 2030 — BenBajarin · 2026-10-24
- Railway publishes preliminary report on Oct 21 security incident, users urged to act — kingslyj · 2026-10-24
- Moonshot explains its capped-cyber-capability strategy for K3.1 Pro open weights — cephaloform · 2026-10-24
- Moonshot says K3.1 Pro's offensive cyber capability is deliberately capped below frontier — dejavucoder · 2026-10-24
- Researcher links recent lone-actor attacks to abliterated DeepSeek 4.1 Flash via ARTEX — MatthewMcAteer0 · 2026-10-24