Vulnerabilities are piling up and everyone blames the agents

GitLab disclosed attempted exploitation of CVE-2026-97229, and the details stung. Upgrading to 19.3.6 on October 22 did not fix it, because the fix is a patch to Ruby that GitLab applies only in its official packages. Anyone running a custom image stayed exposed. Commenters traced the root cause to an integer overflow in a C data-processing library, in regex handling, leading to RCE. The same day brought a full-chain Microsoft Edge exploit built from logic bugs only, a zero-click remote Android DoS, and a chained PHP2Shell exploit that rooted 25 servers including US government ones.

The pattern here: security writeups now openly assume AI does the legwork. The Edge post skips detail because "in this era, you can just ask your agents to fill in the details." Commenters ask whether researchers have coined "Superbug" or "MegaVuln" yet, and joke that an LLM will soon find a critical, unfixable flaw in every device. One commenter begs people to stop "vibecoding a new website for every vulnerability." Fatigue with old C libraries is the loudest sentiment.

The counterpoint is that the Edge writeup was praised as rare human craft. Careful manual exploit work is becoming the exception, which makes it more valued.