# Vulnerability Curve Tracks AI Curve: CVE Volume Surge, Negative Time-to-Exploit and 60-Day Remediation Gap

> ProjectDiscovery analysis reports annual published CVEs rose from 17,964 (2018) to 49,458 (2025), mean time-to-exploit fell from 5 days (2023) to roughly -1 day (2024) and -7 days (2025), and AI-assisted exploit generation is reported at 10-15 minutes. Defender remediation time stays flat at about 55-61 days, leaving a ~60-day exposure gap.

- **Published:** 2026-10-30T16:30:18Z
- **Last reviewed:** 2026-10-30T16:30:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4839
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4839.png
- **ID:** TL-2026-4839
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13

## Description

This is a trend and strategic-risk record, not a single CVE or campaign. It is based on a ProjectDiscovery blog post by Prince Chaddha (2026-06-18). All figures are the vendor's and were compiled from third-party datasets (NVD, CISA KEV, Google Threat Intelligence Group/Mandiant, Edgescan, Sonatype, Cybersecurity Ventures). They have not been independently re-verified here.

Volume: published CVEs rose from 17,964 (2018) to 30,361 (2023), 40,131 (2024) and 49,458 (2025), including 3,579 Critical and 15,868 High in 2025. 30,550 CVEs had been published by 2026-06-03, and the source projects about 290,000 cumulative CVEs by the end of 2026. Linux kernel CNA activity contributed 4,362 CVEs in 2024 and 4,334 in 2025, of which only 9 of the 2024 CVEs reached CISA KEV. CISA KEV added 123 entries in 2025. The NVD analysis backlog exceeded 27,000 unanalyzed CVEs at the end of 2025, and in April 2026 NIST moved pre-March-2026 CVEs to 'Not Scheduled' and began enriching only KEV and high-risk CVEs.

Exploit timing: the source reports mean time-to-exploit falling from 63 days (2018-2019) to 44, 32 and 5 days (2023, outlier-adjusted; 47 days with outliers), then to roughly -1 day (2024) and -7 days (2025), with about -13 days projected for 2026. A negative value means exploitation is observed before public disclosure. In 2023, 70% of exploited vulnerabilities were zero-days, and 430+ zero-days were exploited in the wild through 2025. Critical-vulnerability time-to-remediate stayed at about 55-61 days, which leaves an exposure gap of roughly 60 days. About 60% of breaches involve a vulnerability with an available patch. Log4Shell-vulnerable components were still pulled about 40 million times in 2025.

AI acceleration: the source cites the CVE-Genie framework reproducing 51% of 2024-2025 CVEs with verified exploits at about $2.77 per exploit and 10-15 minutes each, and GPT-4 judging 87% of tested CVEs exploitable from the description alone.

Supply chain: Sonatype counts of malicious open-source packages were 245,032 (2023), 512,847 (2024) and 454,648 (2025), with 21,764 in Q1 2026 and more than 1.35 million cumulative. The source names the Shai-Hulud npm worm (2025, 500+ packages) and Shai-Hulud 2.0. Microsoft documents Shai-Hulud 2.0 as active 2025-11-24 to 2025-12-01. It uses an npm preinstall script (set_bun.js / setup_bun.js) that installs the Bun runtime and runs bun_environment.js. The payload harvests cloud, SSH, npm and wallet credentials, exfiltrates them to attacker-controlled public GitHub repositories, and registers a GitHub Actions self-hosted runner named SHA1HULUD. A 'Mini Shai-Hulud' variant (2026-05-11; 170+ npm and 2 PyPI packages per Microsoft) persists through a .claude/settings.json SessionStart hook. No actor, CVE or network infrastructure is attributed in the primary source.

Defender implication: patch-by-CVSS/NVD-enrichment workflows lag exploitation. Prioritize KEV and exploitation-evidence feeds, virtual patching and compensating controls, exposure validation, and package-registry and CI/CD controls (lockfiles, install-script restrictions, token rotation).

## MITRE ATT&CK

- T1587.004 Exploits
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1203 Exploitation for Client Execution
- T1547 Boot or Logon Autostart Execution
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1526 Cloud Service Discovery
- T1567.001 Exfiltration to Code Repository
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Shai-Hulud 2.0 npm Preinstall Loader Execution — Exploitation Phase** (`TL-2026-4839-SPL-001`)

TL-2026-4839: detects node/bun executing setup_bun.js, set_bun.js or bun_environment.js, the Shai-Hulud 2.0 preinstall loader chain (T1195.002, T1059.007). Behaviour-first: fires on the process chain that a trojanized npm package triggers at install time, regardless of package name.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1059.007
- **Data sources:** sysmon, index=sysmon XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```Shai-Hulud 2.0 (Sha1-Hulud) npm preinstall loader: node runs setup_bun.js / set_bun.js, Bun then runs the ~10 MB bun_environment.js payload. TL-2026-4839 T1195.002 T1059.007```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (CommandLine="*setup_bun.js*" OR CommandLine="*set_bun.js*" OR CommandLine="*bun_environment.js*")
    (Image="*node.exe" OR Image="*bun.exe" OR Image="*/node" OR Image="*/bun")
| eval via_pkg_mgr=if(match(lower(ParentCommandLine),"npm|yarn|pnpm|preinstall"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users values(via_pkg_mgr) as via_pkg_mgr by Computer
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table Computer users parent_images command_lines via_pkg_mgr count first_seen last_seen
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node.exe", "bun.exe", "node", "bun")
| where ProcessCommandLine has_any ("setup_bun.js", "set_bun.js", "bun_environment.js")
| extend ViaPackageManager = InitiatingProcessCommandLine has_any ("npm", "yarn", "pnpm", "preinstall")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ViaPackageManager
| order by Timestamp desc
```

### Sigma

```yaml
title: Shai-Hulud 2.0 npm Preinstall Loader Execution
id: 6f1b0c52-7a3e-4d0b-9c58-1e2a4b7d9a01
status: experimental
description: Detects node or bun executing the Shai-Hulud 2.0 (Sha1-Hulud) loader or payload files setup_bun.js, set_bun.js and bun_environment.js, typically launched from a package.json preinstall script of a trojanized npm package.
references:
    - https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/
    - https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve
author: Threadlinqs Team
date: 2026-10-30
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\node.exe'
            - '\bun.exe'
    selection_cli:
        CommandLine|contains:
            - 'setup_bun.js'
            - 'set_bun.js'
            - 'bun_environment.js'
    condition: all of selection_*
falsepositives:
    - Internal packages that legitimately ship a file named setup_bun.js
    - Developers testing the Bun runtime with similarly named scripts
level: high

```

**Known false positives:**

- Internal tooling or packages that happen to ship a script named setup_bun.js
- Developers experimenting with the Bun runtime using the same file names

**Tuning notes:** Filter known-good internal repos by ParentCommandLine or working directory. Run on CI runners and developer endpoints first. For Linux build hosts feed the same logic from Sysmon for Linux or auditd execve. via_pkg_mgr=yes with a recent npm install is the highest-fidelity subset.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Bun Runtime Bootstrap by Node/npm Install Script — Exploitation Phase (locked: unlock with TL Creds)
- Mini Shai-Hulud .claude SessionStart Persistence — Post-Exploitation (locked: unlock with TL Creds)
- Bun/Node Payload Exfiltrating to GitHub — C2 / Exfiltration (locked: unlock with TL Creds)
- Log4Shell JNDI Exploitation Attempt in Web Requests — Exploitation Phase (locked: unlock with TL Creds)
- Cloud Secret Enumeration by Node/Bun — Post-Exploitation (locked: unlock with TL Creds)
- GitHub Audit: SHA1HULUD Self-Hosted Runner Registered — C2 / Persistence (locked: unlock with TL Creds)
- SHA1HULUD Self-Hosted GitHub Actions Runner — Post-Exploitation (locked: unlock with TL Creds)
- Node/Bun Access to Cloud Metadata Endpoints — C2 / Credential Theft (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The Vulnerability Curve Bent With the AI Curve (ProjectDiscovery, Prince Chaddha)](https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve)
- [Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack (Microsoft)](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/)
- [Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis (Google Threat Intelligence Group)](https://cloud.google.com/blog/topics/threat-intelligence/2024-zero-day-trends)
- [2025 Zero-Day Review (Google Threat Intelligence Group)](https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review)
- [Time-to-Exploit Trends 2023 (Mandiant / Google Cloud)](https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023)
- [NIST NVD enrichment policy shift (Help Net Security)](https://www.helpnetsecurity.com/2026/04/16/nist-national-vulnerability-database-nvd-enrichment/)
- [CVE pileup: NVD missed deadline (The Register)](https://www.theregister.com/2024/10/02/cve_pileup_nvd_missed_deadline/)
- [NVD Backlog Crisis Deepens Amid Surging CVE Disclosures (Socket)](https://socket.dev/blog/nvd-backlog-crisis-deepens-amid-surging-cve-disclosures)
- [Sonatype Q1 2026 Open Source Malware Index](https://www.sonatype.com/press-releases/sonatype-q1-2026-open-source-malware-index)
- [Understanding the New Negative Time-to-Exploit (Hadrian)](https://hadrian.io/blog/understanding-the-new-negative-time-to-exploit)
- [Edgescan 2024 Vulnerability Statistics Report](https://www.edgescan.com/wp-content/uploads/2025/04/2024-Vulnerability-Statistics-Report.pdf)
- [Wiz Research Shai-Hulud 2.0 compromised packages list](https://github.com/wiz-sec-public/wiz-research-iocs/blob/main/reports/shai-hulud-2-packages.csv)
- [ProjectDiscovery vulnx](https://github.com/projectdiscovery/vulnx)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4839