AI Raises the Stakes for Open-Source Security
AI has made finding security flaws fast, so safely fixing them is now the hard part.
Summary
Open-source software now makes up roughly 90% of a modern enterprise codebase, while AI has shortened vulnerability discovery from weeks to minutes. Project Glass Wing found 2,300 vulnerabilities across 400 projects, and Mandiant data shows exploits arriving an average of 70 days before patches rather than 63 days after them in 2018–2019. That pressure makes 30-day remediation windows inadequate and raises the need for signed artifacts, package cooldowns, hardened developer systems and faster fixes, while human maintainers still must validate backports and compatibility. PHP illustrates the danger in practice: two remote-code-execution flaws persisted across roughly 14 years of releases, from PHP 5 through PHP 8.5, with a working exploit released by 9BIE.