Canonical Moves Ubuntu to Two-Week Stable Release Cycle as AI-Driven Bug Hunting Swells CVE Volume

Slashdot reader BrianFagioli, writing about the change, noted that finding vulnerabilities faster also puts pressure on Linux distributions to fix and deliver patches faster. In a blog post, Canonical said AI has transformed bug discovery from "a manual, time-intensive process into a highly automated engine," contributing to a "recent explosion in the volume of CVEs."

Canonical pointed to a second factor behind the increase. The upstream kernel community became its own CVE Numbering Authority and began assigning CVE identifiers to thousands of bugs, arguing that at the kernel level almost any type of bug that can affect a running system could potentially be classified as a vulnerability. Canonical said the result is that CVE volume has skyrocketed exponentially, creating a backlog of alerts and forcing defenders to increase the speed of their fixes sharply to close the window of risk.

Under the new cycle, Canonical said it aims to provide safe workarounds where applicable while a patch is being prepared, so users are not left exposed in the meantime. Where no safe workaround exists, the company said it will say so clearly and point users toward general hardening steps instead. The stated goal is to get environments into a defensible, safer state within 24 to 48 hours of public disclosure, well before a patch ships. Canonical described the approach as buying the time needed to fix a vulnerability properly rather than replacing the patch itself.

The blog Nerds.xyz framed the trend differently. "Linux did not suddenly become wildly insecure overnight," it wrote. "We are getting much better at finding and cataloging problems that may have previously gone unnoticed."

According to the Slashdot account, there is an irony in the shift: AI is routinely pitched as a tool that makes software development faster, but it is also making vulnerability discovery faster, which means maintainers now have to accelerate the other side of the equation. For Ubuntu users, the account concludes that the change should ultimately be good news, on the view that more bugs being discovered is preferable to vulnerabilities sitting unnoticed in the Linux kernel.