The CVE spike across major software companies is a remediation problem

The article argues that the recent jump in CVE counts reflects AI-accelerated discovery rather than a sudden drop in software quality, and warns that institutional bottlenecks (NIST scoring backlogs, slow remediation) create the real risk. It highlights that known-exploited vulnerabilities are often not patched quickly enough—citing Verizon data and the StyleSmuggler RCE—and promotes automated reachability analysis and AutoFix-style remediation as necessary responses to prioritize and fix true risks faster.