The Myth of the Meteoric Rise in Vulnerabilities
summary
Argues that rising CVE counts are inflated by mass reporting of trivial clones rather than a real security collapse: analysis of SourceCodester shows 369 re-skinned PHP projects producing ~1,700 CVEs with only 16% covered and an estimate of 15,243 CVEs ready to be assigned and a possible CVE factory effect; shows a 1997‑style Android SSL spike (1,420 CVEs from a million‑app scan) and a Saturday audit using Claude that finds 203 exploitable issues in 15 WordPress plugins (developers patch some within two weeks); documents CNAs issuing duplicate CVEs for identical code and urges risk‑centric triage.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 5:01Early vulnerability data
- 7:11Public exploit databases
- 9:19CNAs and CVE assignment
- 12:26CVE assignment rules
- 14:11Free code repositories
- 17:42Vulnerable student projects
- 20:33Mass-producing CVEs
- 22:40False CVEs in student projects
- 24:27WordPress plugin testing
- 26:32Summary
related talks
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
01mEvolution of CVEs and Vulnerability Management
39mCVE 101: The Unfolding Of A Zero Day Attack
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
54mTowards Real World Cyber Risk (Panel)