Zero-Day Exploits Surge as AI-Generated "Fake" Code Floods Vulnerability Landscape

The global cybersecurity industry is facing a paradoxical crisis as the "threat ceiling" for defensive practitioners continues to rise while the quality of reliable data falls, according to a major new research report released yesterday by VulnCheck.

The 2026 Exploit Intelligence Report reveals that despite increased spending on enterprise-grade early warning systems, most threat notifications still trail real-world risk by days or weeks. This data fragmentation has left organizations struggling to establish a basic ground truth on vulnerabilities, even as adversaries weaponize new flaws with unprecedented speed. A core driver of this instability is a 16.5% year-over-year increase in exploit coverage, fueled largely by a surge in AI-generated proof-of-concept code, much of which the report identifies as non-functional or outright fake.

The report, which draws on over 500 data sources, tracked more than 14,000 exploits developed for 10,000 unique vulnerabilities disclosed in 2025. While the volume of public code is at an all-time high, the actual "strike rate" remains concentrated; a mere 1% of vulnerabilities identified in 2025 were confirmed to be exploited in the wild by the end of the year. However, when exploitation does occur, it happens with alarming velocity. Nearly half of the vulnerabilities added to VulnCheck’s Known Exploited Vulnerabilities dataset in the past year were for flaws identified within that same calendar year, underscoring a rapid collapse in the time between a vulnerability’s discovery and its active use by attackers.

Ransomware trends in 2025 further highlight the growing sophistication of high-tier adversaries. While the total number of new vulnerabilities linked to ransomware incidents remained small, a staggering 56.4% of them were the result of zero-day exploitation. Compounding the challenge for defenders, one-third of these known ransomware vulnerabilities still had no public or commercial exploits available as of early 2026, leaving security teams effectively blind to the tools being used against them. Geopolitical shifts also influenced the landscape, with a notable increase in exploits attributed to China-nexus threat groups, such as Earth Lamia, even as activity from Iranian state-sponsored actors saw a decline.

To combat the opacity of current threat intelligence, VulnCheck has introduced the industry’s first annual list of "Routinely Targeted Vulnerabilities." This community resource identifies 50 specific flaws from the past year that carry elevated, multi-dimensional threat profiles, aiming to help organizations prioritize their patching efforts amid a sea of unreliable data. As the industry grapples with the dual pressures of AI-generated noise and high-velocity zero-day attacks, the report suggests that the solution lies not in more tooling, but in a radical shift toward data quality and consumability to close the gap between disclosure and defense.