On Alpine Linux this week, you could type any password of 257 characters or more and sshd let you in.

On Alpine’s AWS and Azure images, that meant root.

The cause is almost a joke. An account with no password stores * instead of a hash. Alpine’s C library returns * when a password is too long. sshd compares * with *. Match. You’re in.

The bug had been there for years. Özgün Kültekin found it with “agent swarms” that threw 17,600 weird logins at sshd. That’s how bugs get found now.

The Flood

  • January 2026: 4,302 CVEs.
  • October 2026: 17,052 CVEs. About one every 2.6 minutes.
  • This year so far: almost 90,000. All of 2025 was about 48,000.

AI is a big part of it. Anthropic alone has reported 5,087 bugs in 680 open-source projects. curl shipped a record 24 security fixes in one release. The Linux kernel published 432 CVEs in two days.

And the bugs are real. curl’s Daniel Stenberg says the AI junk reports are “practically gone.” Now it’s real bugs, faster than people can fix them.

Nobody’s Checking

NIST used to score every CVE. In April it stopped. Most new CVEs now get no score from NIST at all.

In July one account filed 54 fake CVEs. They still got rated critical before anyone pulled them.

I’ve argued that [vulnerability] numbers are meaningless. This month’s number, 1,413, is no different.

— Tyler Reguly, Fortra

Don’t Panic

Here’s the good news. Bugs that attackers actually use grew 32% this year. Not 300%.

Microsoft fixed about 1,400 flaws in October. One was under attack.

You can’t patch everything. You don’t need to. Do the basics:

  • Know what you run. Lockfiles, containers, servers. You can’t patch what you don’t know about.
  • Patch on a schedule. Weekly. Let Renovate or Dependabot merge minor updates when tests pass.
  • Patch exploited bugs today. Check CISA’s KEV list. It’s short.
  • Restart after you patch. Upgrading a package doesn’t replace a running server.
  • Turn off what you don’t use. Password logins on SSH. Old services. Open ports.
  • Don’t expose dev tools. Dev servers, admin panels and databases stay off the public internet.
  • Cut dependencies. Every package you drop is a CVE you never read.
The list misses things

The Alpine bug had no CVE when the fix shipped. A process built only on CVE feeds would have missed it. Follow a couple of good security accounts, and keep the basics in place for the bugs nobody has named yet.

The Bottom Line

AI made bugs cheap to find. It didn’t make them cheap to fix.

In September I checked my own Mac: 28 of 47 repos pinned a vulnerable Vite. I’m not patching 28 repos every time a CVE lands. I’m patching the ones that are exposed, and keeping the rest on a schedule.

The haystack will keep growing. Stop counting hay.

Related Posts