Warnings of the “vulnpocalypse” are crowding conference presentations, headlines, and conversations among security professionals. Are the end times near?

AI is enabling attackers to find and exploit more vulnerabilities than before. We’ve felt it as the number of Zero-Day Alerts (ZDAs) sent each quarter has trended upward — with a distinct surge in 2026. The volume may be unprecedented, but the solution is straightforward: Know where to focus.

That’s exactly what our ZDAs help policyholders accomplish. Despite the growing number of vulnerabilities, the majority of policyholders still don’t receive a single notification. The vulnerability surge is manageable as long as security teams spend less time focused on hundreds of supposed “critical” risks that are unlikely to be exploited, and instead spend more time remediating  actual threats.

ZDA Snapshot

• Coalition sent 45 ZDAs between May 1, 2026 and August 1, 2026

• 94% of policyholders didn’t receive a single notification

• 77% of ZDAs featured web design technology

• 59% of notified policyholders have fewer than 25 employees

Below, we’ll explore how we’re helping policyholders navigate record-breaking vulnerability volume, the impacts of risk aggregation, and which businesses are most likely to receive ZDAs.

1. Helping policyholders navigate record-breaking Patch Tuesdays

The pressure is on both vendors and security teams to find issues before attackers can abuse them. In July, Windows shared that it would apply AI across security analysis to find vulnerabilities earlier and at greater scale.

This likely contributed to the record-breaking Patch Tuesday in June with 206 vulnerabilities. In July, the number nearly tripled to 569. Prior to the adoption of multi-model AI for vulnerability discovery, Microsoft typically shipped around 100 fixes each month. 

As soon as the vulnerabilities are disclosed, the clock starts ticking for organizations to act. Earlier this year, Anthropic disclosed that Mythos could create working exploits for newly discovered vulnerabilities in hours, as opposed to weeks. For security teams, this translates to an unprecedented volume of alerts every month to parse through and less time to do it. 

Straightforward prioritization with ZDAs 

Of all the vulnerabilities addressed in Microsoft’s July Patch Tuesday, roughly 60 were rated critical. More than 500 were rated important. Coalition continues to narrow the focus to which flaws we believe are most critical from an external exposure standpoint. In July, we sent two ZDAs on the same day as Patch Tuesday: 

• SharePoint

  • CVE-2026-56164 was added to CISA KEV on the same day as publishing and exploited as a true zero-day. With a Common Vulnerability Scoring System (CVSS) score of 5.4, it’s not particularly alarming on its own. But our analysis found that the nature of the vulnerability could make it an entry-point for other, more severe vulnerabilities. Subsequently, NVD enrichment gave it a 9.8 critical rating. 

  • CVE-2026-58644 was added to CISA KEV two days later. It’s a remote code execution (RCE) vulnerability that requires Site Owner privileges, which CVE-2026-56164 grants. 

  • CVE-2026-50522 is a standalone RCE that permits an unauthorized attacker to execute code over a network. 

• Windows Message Queueing

  • CVE-2026-50447 is a heap-based buffer overflow in Windows Message Queuing that allows unauthorized attackers to execute code over a network.

The expectation is not that policyholders will neglect the rest of the Patch Tuesday release, but that those at high-risk due to the above vulnerabilities will know where to start to dramatically reduce their exposure. Coalition continues to monitor and alert policyholders to the most critical risk following Patch Tuesday releases.

When evaluating what made the cut (among the 569 vulnerabilities), we found that many of the flaws weren’t noteworthy on their own or didn’t carry a particularly high CVSS score. The forest mattered more than the trees. Take, for example, CVE-2026-56164, a vulnerability that is low-risk on its own but an avenue for RCE when chained with CVE-2026-58644. 

Chaining vulnerabilities was once labor intensive for attackers, but AI agents allow for an entirely automated workflow.

We saw the similar impact of chained vulnerabilities with WP2Shell (more on that below). Chaining vulnerabilities was once labor intensive for attackers, but AI agents allow for an entirely automated workflow. As Microsoft accounts for entire attack chains, it’s likely that the total volume of fixes will continue to swell.

2. 77% of ZDAs feature web design technology

Attackers are looking for the path of least resistance. Certain technologies, such as boundary devices or email servers, appear frequently in our ZDAs,  as vulnerabilities can offer a direct route to the victim’s network. But web design far surpassed any other technology class, accounting for 77% of all ZDAs.

WP2Shell

Rare vulnerabilities in WordPress Core (WP2Shell) accounted for 44% of all ZDAs, following a discovery by security researcher Adam Kues. WordPress is one of the most widely deployed content management systems (CMS), powering approximately 43% of all websites. Kues pointed a frontier model at WordPress code for 10 hours to discover the full RCE chain and claimed that “no security researcher could have found and completed this exploit chain in 10 hours without AI.”

Rare vulnerabilities in WordPress Core (WP2Shell) accounted for 44% of all ZDAs, following the discovery by security researcher Adam Kues.

On July 17, the same day as the public disclosure, Coalition notified impacted policyholders about the two chained vulnerabilities in WordPress Core. Attackers could chain together CVE-2026-63030 and CVE-2026-60137 to achieve unauthenticated remote code execution, resulting in complete compromise:

• CVE-2026-63030: REST API batch-route confusion vulnerability 

• CVE-2026-60137: Does not properly sanitize the ‘author__not_in’ parameter of ‘WP_Query,’ which could allow SQL injection when a plugin or theme passes untrusted input to the parameter

On July 20, Coalition observed active exploitation of the WP2Shell vulnerabilities on our honeypots, reinforcing the need for policyholders to patch urgently.

Drupal

On May 20, Coalition notified impacted policyholders of a critical vulnerability (CVE-2026-9082) within Drupal, an open-source CMS. The Drupal vulnerability alone accounted for 12% of ZDAs. 

Drupal runs an API designed to ensure that database queries are sanitized to prevent SQL injection attacks. The vulnerability is located in the API and allows attackers to send specially crafted requests, resulting in arbitrary SQL injection on sites using PostgreSQL databases. We sent out our ZDA to at-risk policyholders with instructions on how to patch.

WordPress Plugins

WordPress plugins accounted for 10% of ZDAs. WordPress plugins often appear in a significant portion of ZDAs each quarter, primarily due to the nature of the technology. WordPress plugins are created by third-party developers as part of a third-party ecosystem that isn’t comprehensively audited by WordPress, and security quality can vary widely. Because many of these plugins are not regularly maintained, they are a welcome avenue for threat actors.

3. 59% of notified policyholders have fewer than 25 employees

Employees per notified policyholder

Of all policyholders that received a ZDA, 59% had fewer than 25 employees. 

For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Small and midsize businesses (SMBs) are typically the most strapped for resources and time, which often means they lack vulnerability management processes. For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Coalition sends ZDAs with clear steps for remediation to make patching as straightforward as possible. ZDAs are meant to supplement, not replace, a policyholder’s own patching and vulnerability management practices. While we can’t control how AI is shaping the volume of threats, we can make risk mitigation accessible for even the smallest businesses.

Notifications per policyholder

The majority of policyholders (94%) did not receive a single ZDA from us. Of those that did, 91% received just one.

While the “vulnpocalypse” introduces an overwhelming number of vulnerabilities, the majority have no confirmed exploitation. Between 2018 and 2025, the share of newly published CVEs with confirmed exploitation remained below 2.2%, even as annual CVE volume grew 2.5 times. 

Businesses that try to patch everything at once risk being overwhelmed. When we send ZDAs, we consider business impact and the legitimate risk of exploitation. The intention is to cut through the noise and guide businesses to focus on the same small percentage of risks that adversaries do.

Policyholders notified by industry

We observed a reasonably balanced dispersion of ZDAs sent across sectors. This is to be expected, as no industry is immune from the risk of aggregation events or vulnerable software.

Staying ahead of threats in the AI era

Autonomous discovery tools have fundamentally changed how security teams respond to critical threats. Moving fast isn't enough; defenders must evaluate vulnerabilities holistically based on potential financial loss. While traditional CVSS scores offer a baseline, they don't directly translate to real-world business impact.

Coalition delivers timely, prioritized ZDAs straight to policyholders’ inboxes when data indicates a vulnerability threatens their bottom line. Along with step-by-step remediation guidance, policyholders can access third-party risk management and attack surface monitoring through Coalition Control®, our cyber risk management platform.

EASILY SPOT & STOP CYBER THREATS IN ONE PLACE

Coalition Control

Take control of your cyber risk >

This blog post is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional advice is required, the services of a professional should be sought. Nothing in this blog post modifies or forms part of any insurance policy, and coverage is subject to the terms, conditions, and exclusions of the applicable policy. Neither Coalition nor any of its employees make any warranty of any kind, express or implied, or assume any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product or process disclosed. Vulnerability information changes rapidly; this post reflects information available as of its publication date. Zero-Day Alerts and related monitoring are not guaranteed to identify every vulnerability or threat and do not replace a policyholder’s own security and patch management practices. Any action you take based upon the information contained herein is strictly at your own risk. Coalition and its affiliates will not be liable for any losses and damages in connection with your use or reliance upon the information. This blog post may include links to other third-party websites. These links are provided as a convenience only. Coalition does not endorse, have control over nor assume responsibility or liability for the content, privacy policy or practices of any such third-party websites. 

Copyright © 2026. All rights reserved. Coalition, Coalition Control and the Coalition logo are trademarks of Coalition, Inc. All other products and company names are the intellectual property of their respective brand owners.