40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
summary
History shows concrete shifts and stubborn repeats: 50,000 CVEs now, projecting 290k by year end, active exploitation overtakes phishing, and complexity plus AI-generated code increases unknowns. Countermeasures that matter are specific: tools: ASLR DEP fuzzing SLSA SBOM parameterized queries, and ecosystem fixes that put safety into frameworks and languages. Learn from real incidents: Heartbleed SolarWinds leftpad event-stream — what was exploited, which controls actually prevented damage, and which fixes required adoption to work.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:59First software exploit 1965
- 7:14Morris worm and CERT
- 10:48Java and memory corruption
- 13:37Microsoft's security shift
- 17:10DevOps IoT XSS challenges
- 20:43Heartbleed vulnerability
- 23:10Go Rust security by default
- 25:17Supply chain attacks
- 27:47SLSA SBOM supply chains
- 29:1550,000 CVEs exploitation
- 31:03AI security challenges
- 32:28Collaboration future of AppSec
related talks
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
39mSoftware Security Engineering (Learnings from the past to fix ...)
15mKeynote
39mCVE 101: The Unfolding Of A Zero Day Attack
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
54mTowards Real World Cyber Risk (Panel)
57mSeeing the Vulnerable Forest Through the Exploited Trees