shellsharksshellsharks@shellsharks.social
Oct 16, 2026, 12:03 PM
Shoutout to @campuscodi and risky.biz. I went through every (and I mean *every*) newsletter (https://risky.biz/newsletters/) dating back to 2022 to pull out any “named vulnerabilities” that I didn’t yet have in the Vulnerability Garden (https://vulnerability.garden). Despite how thorough I’ve been, adding these throughout the years, I still managed to find just shy of 100 (99 to be exact) new vulns to add to the list. Thanks to Catalin for contributing to the madness! 🪴
💬 1🔄 0⭐ 0

Replies

hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪 4hrbrmstr@mastodon.social
Oct 16, 2026, 12:39 PM
@shellsharks nice update to the tracker!
So, we've just about had three "eras" and I sincerely hope that AIs don't start naming and logo-ing their vuln finds b/c I rly don't want to see what their fourth era would look like on the chart.
$A line graph titled "shellsharks Vulnerability Garden Tracker" shows the cumulative sum of 1,270 tracked "celebrity" vulnerabilities over time, plotted on a $\log_{10}$ scale for the y-axis. The subtitle explains that on a log scale, a straighter line indicates steadier growth, and a steeper line indicates faster growth. The x-axis represents the "Publish Date" with markers for 1990, 2000, 2010, and 2020. The y-axis, "# Celebrity Vulns," uses a logarithmic scale with markers at 1, 10, 100, and 1,000. The graph is divided into three distinct "eras" by vertical dashed lines: * **2000–2013:** The first era saw 28 vulnerabilities in 14 years, with the total doubling approximately every 4.1 years. * **2014–2018:** Labeled as a "Breakout" period, growth accelerated from 19 per year to 63 per year, with the total doubling approximately every 1.7 years. This is represented by a visibly steeper segment of the line. * **2019–2026:** This era is described as "Steady compounding," with the total doubling approximately every 3.3 years. An arrow at the end of the line points to the final data point, noting that by October 15, 2026, there were 265 vulnerabilities, compared to 151 in all of 2025. The final cumulative count ends above the 1,000 mark. The source is listed as https://vulnerability.garden/.$
💬 1🔄 0⭐ 0
shellsharksshellsharks@shellsharks.social
Oct 16, 2026, 1:04 PM
@hrbrmstr Thanks! I think the fourth era has kinda began this year imo. We’re on track to basically more-than-double what any previous year had and it’s definitely thanks to AI. I don’t think the AI itself is naming the vulns it produces, but there’s a lot of smaller AI vuln research shops that have popped up and they sure do love to name their findings, even ones that you could argue are not that notable/severe. Named vulns have always been about marketing, so that’s what these shops are doin’
💬 0🔄 1⭐ 0