Cybersecurity's 2026 Wild Ride

NotPetya, WannaCry, NIMDA, SQL Slammer. It is probably going to be worse than these.

An update to this article has been posted showing what has happened in the following 3 weeks… and things are happening even faster than expected.

We are about to enter the wildest period of cybersecurity we’ve ever seen. NotPetya, WannaCry, NIMDA, SQL Slammer. It is probably going to be worse than these. Expect multiple rounds of exploits across infrastructure, industries, and markets, with each wave hitting large parts of all of them.

Yes, this sounds like hyperbole. It isn’t.

On the other side of it we will be more secure than ever.

After all the fixes have been made and all the updates have been run, software quality will be exponentially better than it is today. This is the end of Defense as our primary cybersecurity posture.

---

TL;DR:

• AI can now find decades-old vulnerabilities on demand; Mythos and GPT 5.4-Cyber are the first wave, and the tooling is about to go commodity.

• CLASP-class attacks weaponize the patching process itself. The better your hygiene, the more exposed you are. Low signal-to-noise in AI-generated bug reports gives patient attackers cover to plant the next generation of supply chain backdoors.

• Outsourced resilience (IR retainers, cyber insurance, managed detection) fails exactly when everyone calls at once. Companies are laying off the in-house expertise they’ll need to recover.

• The transition will hurt. The far side will be more secure than anything we’ve ever built.

---

The new AI capability landscape -- Mythos, GPT 5.4-Cyber, and the CLASP attack pattern they enable -- is what makes 2026 structurally different from any prior cyber era.

Why 2026?

I’ve lived through a few cyber eras. Morris Worm in ‘88. Code Red and NIMDA in 2001. SQL Slammer in 2003. Conficker. Heartbleed. WannaCry. SolarWinds. xz utils. Each one felt, at the time, like the roof was coming off.

In hindsight, each of those was a single event, or a single class of event. One worm. One backdoor. One library. The industry absorbed the hit, wrote the post-mortem, issued the patches, and moved on. Slightly scarred, slightly smarter.

That’s not what’s coming. What’s coming is a bunch of these, all at once, sustained across months.

Mythos hit 100% on the professional cybersecurity challenges that the best AI scored 0% on last year. It found a 27-year-old bug in OpenBSD. A 16-year-old one in FFmpeg that had survived five million automated tests. A 17-year-old RCE in FreeBSD. 99% of the vulnerabilities it surfaced are currently unpatched.

The bugs aren’t new. They’ve been sitting there the whole time. Mythos just gave us a flashlight bright enough to see them.

The flashlights are becoming available to everyone, good and bad. Open source models with equivalent capability are a few months out. Mythos and GPT 5.4-Cyber will be generally available soon. Every state actor, every ransomware crew, every script kid with an API key is about to get the same flashlight.

Decades of latent vulnerabilities. A new generation of tooling that can find them in hours. And new capabilities that can weaponize them, opening up new attack patterns like CLASP that weaponize the very process we use to patch them.

With CLASP, the patch is the distribution vehicle, not the attack -- the malicious code was merged into the codebase weeks earlier (typically via a prior supply-chain compromise or maintainer trust infiltration), sitting dormant. Reviewing the patch diff catches nothing because the malware is in the baseline. Organizations with the best patching processes are most vulnerable to CLASP attacks. This does not mean slow down patching -- it means patching alone is no longer sufficient if the upstream supply chain is compromised. See the CLASP advisory for details, but here is how it works:

Infographic: https://clasp.info/assets/img/clasp-infographic.png · Advisory:

https://clasp.info

The Perfect Storm

I don’t have a timeline with exact dates, but I do have a list of converging dangers to watch for.

1. CVE Triage Collapse. The CVE system, CERT/CC, NVD, and vendor security teams are already straining. When the flood arrives, prioritization breaks down. “Critical” becomes meaningless when everything is critical. Patch cadence accelerates from 30 days to 14 to 7 to “deploy on disclosure” and still can’t keep up.

2. The Great Patch Flood. Mass disclosure of long-dormant vulnerabilities across operating systems, browsers, cryptographic libraries, widely-used open source packages, and embedded firmware. Not dozens. Thousands. Many may be 10+ years old. Some will be baked into devices that can’t be patched at all -- routers, IoT, industrial control. Add in “patch slop” from AI generated hallucinations of problems and fixes that will overload issues and PR queues, this will have the effect of simultaneously:

• overloading maintainers with reported issues to triage

• introducing record levels of pull requests that need to be reviewed

• introduce more opportunities for supply chain attacks to slip through in the volume of updates

• better AI-assisted obfuscated malware alongside of the wave of legitimate fixes

3. CLASP-class attacks. Most likely a nation state first or commercial crews will be the first to execute the full CLASP chain with a supply chain compromise plus legitimate emergency disclosure to deploy it at scale. These may be either stealthy espionage attacks or devastating ransomware attacks, depending on the attacker.

4. Cyber Insurance and incident response (IR) capacity breaks. Cyber insurance premiums spike. Carriers withdraw coverage for certain attack classes or refuse coverage as acts of war or other with other exclusions. IR firms are booked solid. When a mass event hits, there are no consultants available. Cloud providers start prioritizing their largest customers for support, leaving smaller ones to fend for themselves.

5. Regulatory whiplash. Governments respond with mandates faster than organizations can comply. Simultaneous demands to patch faster, verify more thoroughly, disclose more broadly, and retain more data -- often contradicting each other. Compliance teams drown.

6. The “not worth exploiting” middle disappears. A lot of software has been technically vulnerable but has not been worth attacking, as the cost of finding and exploiting a bug exceeded the payoff. Highly capable AI collapses that economic barrier. Previously ignored targets such as small banks, regional utilities, supply chain SaaS vendors, local government systems, and more suddenly become worth attacking at scale.

7. Consolidation by catastrophe. Organizations that survive do so by being prepared or lucky. The ones that weren’t either prepared or lucky either get acquired, go out of business, or become cautionary case studies. The distribution is ugly and it isn’t fair, but is typical in extreme market conditions.

8. Quantum is coming. Not today’s problem, but a near-ish future’s problem. Adversaries are recording huge amounts of encrypted traffic today so it can be decrypted in the future. Anything with value that will last years: signing keys, credentials, IP, records, confidential personal, diplomatic and legal communications. Our systems need upgrades to post-quantum encryption protection before it goes on the wire, not after. This will introduce additional large updates across the industry to prepare for this on top of everything else. Start the crypto inventory and migration roadmap this year. If this isn’t on your radar yet, add it.

Patch Flood as Exploit Opportunity

AI-surfaced vulnerability reports have already overwhelmed maintainer review bandwidth. The popular utility curl ended its nine-year HackerOne bug-bounty program in January 2026 after the confirmed-vulnerability rate collapsed from above 15% to below 5% under an “explosion in AI slop reports.” When thousands of AI-surfaced bugfix pull requests hit a maintainer’s queue inside a compressed review window, the human capacity to actually audit each incoming change collapses. That is exactly the condition a patient attacker wants.

Slipping a new, deliberately-planted supply-chain backdoor into a maintainer’s repo has never been easier than it’s about to be, because the legitimate fix traffic provides cover. And AI accelerates the planting side too -- generating plausible maintainer-voice commits, building reputation through high-volume “helpful” PRs, crafting backdoors that read as legitimate bug fixes. The xz utils attack took years of patient social engineering; the AI-assisted version takes months. The wave that cleans the installed base is itself the most target-rich moment to plant the next generation of dormant compromises.

Overwhelmed maintainers and teams are also likely to be more desperate for help and less vigilant in adding new maintainers to a project, which increases the odds of a malicious actor getting insider access on key projects.

Resilience and Layoffs

Outsourced resilience fails when everyone needs help at the same time. Incident response retainers, cyber insurance, managed detection, specialist consultants. The whole “outsourced resilience” category is based on demand being distributed over time. One organization’s crisis is another’s billable hour. In a mass event, that premise breaks. IR firms are booked solid. Insurance carriers withdrawing coverage or declaring force majeure. Cloud providers triaging support toward their largest customers (or themselves). The services you counted on to be available may be the very services that are completely overwhelmed.

Layoffs hollowed out the in-house expertise. Tech companies have cut over 275,000 employees across 2024 and 2025 -- security teams, SREs, platform engineers -- often explicitly framed as “AI-driven productivity gains” (which they usually weren’t, AI was a convenient excuse for corporate downsizing). The organizations about to face the worst operational stress test of their careers have, on average, fewer senior engineers and fewer institutional-memory holders than they did in 2022. Recovery takes people who understand the system. The companies that spent 2024-2025 trading headcount for short-term margin are about to discover what that trade actually cost them -- exactly when the call to rebuild from bare metal lands on a Tuesday afternoon.

AI might not help you. If your recovery plan is “we will ask the AI,” what happens when the AI services are overloaded or compromised themselves. Do you have in-house AI that runs when your external providers are down? What if your internal AI is inside the blast radius of the malware you’re trying to recover from? You will need humans on staff (not just on call, see above) who know your systems.

Quantum is Coming

Quantum decryption is still a decade or more out -- the GRI 2025 expert survey puts it at 28-49% likely by 2036, over 50% likely by 2041. The exploit is not a 2026 problem. The collection is.

Adversaries are already intercepting and warehousing encrypted traffic today -- “harvest now, decrypt later” (HNDL). A decade of encrypted highly sensitive communications, basically everything you do online, will at some point in the future be readable.

You can’t un-send the traffic that was captured yesterday. The only defense is starting to migrate to post-quantum encryption methods for everything that will still matter in a decade. The US government’s bet is 2035 via NSA CNSA 2.0; realistic enterprise migration at the installed-base scale (TLS, VPN, SSH, HSMs, embedded crypto) is measured in years to decades. Keep in mind that the quantum decryption countdown is already running, and that some or all of your encrypted traffic is being collected for later decryption by multiple organizations.

How to Prepare

There are two things we need to change to adapt to this wave of challenges. The first is adopting a “survival posture”, and the second is changing your mindset about how to approach security in general in this new environment.

Survival posture -- this is mostly what I already wrote about CLASP mitigations, so I’ll summarize.

• Offline, physically-disconnected backups, rotated regularly. Yes, we’re going old-school with hard drives and backup tapes, unplugged, sitting on shelves. Assume any connected service, including backups and ‘immutable’ archives, is reachable by a sufficiently capable AI-assisted attacker.

• Rebuild-from-bare-metal practiced quarterly, not annually. Most annual disaster recovery (DR) exercises fail. Many backups are found to be insufficient (missed important things) or defective (broken scripts, bad media) when tested. Your teams also need to develop the experience of restoring existing systems from scratch so they can do it under pressure in a crisis.

• Plan for external help being unavailable when you need it most. Outsourced resilience (IR retainers, managed detection, consulting firms) fails exactly when everyone calls at once. Fund in-house recovery expertise as a requirement.

• Know your full dependency tree (SBOM) You need a way to know what security patches affect your systems, so you can triage in minutes.

• Map your kill switches. Not just what you’d turn off, but exactly how, who has authority to authorize it, and the steps to disconnect or powerdown the appropriate systems. You will also need to know if your systems will automatically route around things you turn off and keep running anyway. Self-healing systems should be identified and the procedure to disable them completely must be documented.

• Check your Insurance Policies. Verify what your cyber insurance actually covers under simultaneous-attack scenarios. Find out what exclusions (war, acts of god, etc.) will prevent you from getting your claims paid.

• Use AI for defense. With AI being used to attack systems, AI is often the only thing that can defend against them at the speed needed. Determine where your own AI tools can help protect your systems, reviewing your codebases in CI/CD pipelines, intrusion detection, etc.

• Document and back up the knowledge in your key people’s heads. Key personnel may be unreachable in a crisis, and accidents and military conflicts happen and institutional memory is the first thing to disappear. Use AI interviewing systems to help collect, surface, document, and organize your experts’ knowledge in a form that can be shared across AI systems and internal teams as needed. Full disclosure: we offer these services, but you don’t need to use ours. Use something to create your team’s expertise documentation in a way that’s easy to build and is usable.

The Mindset Shift -- this is the part that will be the hardest to change, but is also the most important. The way we look at security as a purely defensive act needs to change. We need to assume defenses will fail, and focus on resilience as a survival mechanism.

Don’t look at all this as a one-off incident to be managed once and start treating it as a new security ecosystem to operate in. It is just starting; and will probably be pretty brutal through 2027. Organizations that survive the transition will be the ones that internalized a few things early:

• Assume compromise. Not as a worst-case plan. As the baseline operating assumption. Build everything so that any given component or upstream dependency could be compromised at any moment without taking your business down.

• Speed of recovery > speed of prevention. You cannot prevent everything that’s coming. You can absolutely decide how quickly you recover when it lands. The organizations that invest in recovery -- disposable infrastructure, practiced rebuilds, offline backups, trained people -- will outlast the organizations that spent the same money on prevention theatre.

• Reinvest AI savings. Every dollar AI saves you in operational cost -- and there will be a lot of them -- should be partly reinvested in resilience. If you just pocket the savings, you will end up with the worst of both worlds: reduced headcount and the same brittle infrastructure and nobody to fix it if it goes wrong.

Talk to the Board

This is not an IT problem. It is an enterprise continuity problem. If the board isn’t tracking cyber posture the way it tracks revenue and cash runway, the board is asleep at the wheel.

The next board meeting needs to cover, at minimum:

• Offline backups and bare-metal recovery, funded and routine. Not IT hygiene. Board-level. Quarterly rebuild exercises, measured and reported to the board the same way you report cash burn. Offline, physically-disconnected backups with rotation schedules, reviewed in board packets. These two practices are the difference between a recoverable incident and a company-ending one. They do not happen without board-level funding and priority. Without these, AI-assisted exploits can delete all your backups before they attack your systems, and then recovery is no longer an option.

• Internal talent retention. Which of your senior security, SRE, and platform engineers would you lose sleep over if they left next quarter? Which of them are already going or gone through layoffs or dissatisfaction? What would it cost to bring them back or keep them? The organizations best positioned to recover from a mass incident are the ones that still have the people who remember how the system was built. Headcount cuts made in 2024-2025 were a capital-labor trade; the bill is about to come due.

• Explicitly confirm insurance coverage. Cyber insurance policies written before 2026 were underwritten against an older threat model. Pull the actual policy documents. What is covered under a simultaneous-attack scenario? What is excluded? What are the aggregation limits? Carriers are already re-pricing or withdrawing coverage for AI-assisted exploit classes. Know what you have before you need it. Many policies exclude large cyber attacks under systemic or war-driven exclusions. Merck had to fight its carriers all the way to the New Jersey Appellate Division to recover ~$1.4B after carriers invoked the “hostile/warlike action” exclusion against a NotPetya claim -- a fight most companies don’t have the runway to win. Does your policy have the same language? Have you tested it against your general counsel?

• Mindset shift: Defense to Recovery. Marginal prevention spend has hit diminishing returns; marginal recovery spend has not. Stop asking “have we prevented X?” first and start asking “how fast can we recover from X?” That reframe changes every downstream funding decision.

• SaaS dependencies. Critical data often resides in SaaS platforms that we have little control or visibility into: client data in Salesforce, source code in GitHub, identity data in Okta, payments in Stripe, communications in Slack, and others. For each of these, and others you identify, can we back up critical data in a form we can use without the platform? Are we doing this regularly? Is the data being stored offline where an attack could not get to it? Can we operate for a week or more if the platform is unavailable? Any “no” answers are gaps that need to be funded and addressed.

Schedule quarterly posture reporting, with a named board sponsor, real budget authority, and real consequences for the executive team if posture slips.

Better After

Every major cyber crisis that landed on shared infrastructure drove an improvement in those same shared systems. The Morris Worm gave us CERT/CC and the idea that “patching” was a thing. Code Red and NIMDA drove Microsoft’s Trustworthy Computing initiative and rewrote how a generation of software was built. Heartbleed funded the Core Infrastructure Initiative and got serious audit money into open source libraries. SolarWinds pushed the industry toward SBOMs, signed builds, and zero trust architectures.

Single-victim crises (Equifax 2017, the big retail breaches) drove patchier responses -- state-level disclosure laws, lawsuits, fines -- but not the same kind of cross-industry infrastructure work. The 2026 pressure is squarely on shared infrastructure: libraries, build pipelines, certificate authorities, AI tooling, the patching ecosystem itself. So the relevant historical pattern is the first kind, not the second.

While AI accelerates attack, it also accelerates defense. In the short run attackers move first -- they’re running against a defender base that hasn’t yet adopted the same tools. However, In the long run, defenders have the advantage. They have the source code, the telemetry, the deployment pipeline, and the same tools that the attackers are using to analyze code and systems. Once AI-assisted auditing becomes standard in every build process, the economics of shipping brittle code collapses, and the economics of attacking strong code collapses as well.

In the near future, after this painful but transitional period, our systems will be more secure than they have ever been -- and the new best-practices forged during the transition will keep them that way.

Certain Uncertainty

Be honest about uncertainty. We don’t know which sectors will get hit hardest, whether the first CLASP attack or other major cyber incident lands against financial services, healthcare, critical infrastructure, or somewhere unexpected. We don’t know whether the insurance market breaks, bends, or adapts. We don’t know whether the regulatory response will help or hurt.

What we do know, with high confidence:

1. The AI capability that makes this possible is real, demonstrated, and becoming cheaper and more accessible every day.

2. The historical latency of unpatched vulnerabilities in deployed software is decades, and the backlog is enormous.

3. The patching ecosystem has a structural fast-path that CLASP exploits: diff-review-and-deploy assumes the upstream baseline is trustworthy. CLASP shows that assumption can fail at scale.

4. Every prior cyber crisis produced infrastructure that was stronger on the far side.

The distance between here and there covered by organizations making choices, good and bad, under pressure.

The good news is that it isn’t going to last forever. The bad news is we’re in it now and most organizations haven’t noticed yet.

Brace yourself. It’s going to be a wild ride.

---

This post is part of the Pressure Tested series. Subscribe at pressuretested.substack.com.

Related: The CLASP Attack Pattern - Weaponizing Patching Best-Practices | Full CLASP advisory: clasp.info

Brian Gallagher is CEO of LEMA Logic. 45+ years in IT, security, and consulting, including CVE-2006-2042 and other responsibly-disclosed vulnerabilities to financial and security software vendors. Has served on university and governmental incident-response teams. Isle of Man’s national AI Advisory Group (AIAG) member. Open-source contributor and module maintainer on several platforms. Recently quoted in Forbes.