Code review used to be the only way to catch these bugs
Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.
Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.
- 14,090 validated vulnerabilities found in 3,915 projects; only 85 matched previously documented CVEs.
- 92% of findings are non-crashing bug classes invisible to fuzzers: access control, path traversal, injection, prototype pollution, SSRF.
- 5,421 supply-chain findings: 1,280 in dependencies generating 4,141 downstream exposures, 2,776 validated with working PoCs.
- Researchers warn the patch window collapsed: faster discovery plus 55-day average patch deployment aids attackers working from diffs.
- Vendors
- Palo Alto NetworksGoogle
From the original article
3 min read at helpnetsecurity.com
An automated system called NOVA read the source code of 3,915 open-source projects over two months and came back with 14,090 vulnerabilities, each one confirmed through the system’s validation pipeline. Vulnerability researchers at Palo Alto Networks’ Unit 42 built the system and checked its output against the public record afterward.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.