Data and method
Vulnerability counts
Weekly figures (the two scroll charts and the text around them):
- NVD CVE feeds, version 2.0. CVEs counted by published date. Rejected CVEs excluded.
- CISA Known Exploited Vulnerabilities catalogue. Entries counted by date added.
A CVE counts as critical when its first listed CVSS score (v4.0, else v3.1, else v3.0) is rated Critical. Data retrieved 24 October 2026.
| Measure | 2025 (52 weeks) | 24 Aug – 24 Oct 2026 (9 weeks) |
|---|---|---|
| All CVEs | 47,373 (911 a week) | 3,481 a week |
| Critical CVEs | 3,934 (76 a week) | 352 a week |
| KEV additions | 245 (4.7 a week) | 9.1 a week |
Other counts differ by method. vulnerabilitydata.io reports 48,185 CVEs for 2025. NVD’s own scoring rates about 3,365 of them critical (Daniel Christensen, CVE statistics). The figure here uses the first score listed.
Apparently part of the growth in raw CVE counts reflects more organisations issuing CVEs and the Linux kernel assigning CVEs to most fixes. It does not all represent new risk. The KEV series, which counts confirmed exploitation, is the more conservative measure.
Speed of exploitation
- About 26% of KEV entries were added within 7 days of the CVE’s publication (CVETodo, analysis of the CISA KEV catalogue).
- PHP2Shell: CVE-2026-109618 and CVE-2026-109619, disclosed 21 October 2026 (BleepingComputer). Exploit attempts reported by Cloudflare (via Investing.com) and Imperva.
The PHP2Shell cost estimate
The school system is a hypothetical model, not a real department: 1,000 schools, 500 field technicians at about 1,300 on-site hours a year each (650,000 hours), and about 40 senior staff for escalation and co-ordination. Staffing, hours per person and hourly rates are illustrative. One technician visit per school is assumed. Central office staff and school-employed IT staff are excluded.
Derived: - One incident: about 1,300–3,400 hours, or 0.2–0.5% of the program’s annual hours. - Twenty incidents a year: 26,000–67,000 hours, or 4–10%. Twenty is an illustrative figure, not a count.
Open-weight and proprietary models
Monthly best scores on the Artificial Analysis Intelligence Index (v4.3.2, applied retrospectively), October 2025 to October 2026, as compiled by models.lawrencewu.net. Data refreshed 24 October 2026. Some historical values are estimates.
Other sources
- AI adoption in Australian business: CPA Australia, Business Technology Report: Australia 2026.
- AI and employment: Department of Employment and Workplace Relations, AI and employment in Australia, July 2026. Data to February 2026.
- DeepSeek ban: Department of Home Affairs, PSPF Direction 001-2025, 4 February 2025.
- Telstra and REA Group examples: company publications, linked in text.