Broadcom this week shipped dozens of “fixes” for AI-found vulnerabilities for select users of its TrueSource Spring Enterprise platform, a move that highlights a growing push by software platform vendors in using AI to track down and remediate rogue code.
The vendor explained that it recently shipped patches for 89 “novel vulnerabilities” that were pushed to “critical infrastructure customers and others who qualify for early access, ahead of public disclosure.” Broadcom noted it has now used its TrueSource platform to find and distribute fixes for 408 vulnerabilities, deliver more than 1,090 “fixes,” review more than 2,600 reports, and filter out more than 3,000 false alarms.
Broadcom unveiled the TrueSource platform as part of its recent VMware Explore event, a launch that built on its move earlier this year to bolster the Spring ecosystem supply chain security. The TrueSource platform encompasses Broadcom’s portfolio of enterprise open-source software, “verified by engineers and delivered from one trusted source.”
Broadcom uses frontier AI models to scan for and construct patches for vulnerabilities. TrueSource Spring Enterprise customers receive immediate fixes across all supported platform versions, providing legacy releases immediate access while providing security-only patches for current versions to speed deployment. Detailed vulnerability information is then published when fixes reach the community and CVEs are issued.
Purnima Padmanabhan, VP and GM for Broadcom’s Tanzu offering, earlier this year explained that TrueSource is “one brand for everything that we do to give customers secure, clean, open-source libraries and images. And that it's one neck to choke. So before they start building an application, they make sure when you're cooking this recipe, you're making sure the ingredients into that recipe are clean.”
Padmanabhan added that this is increasingly important for enterprises that have been impacted by the surge in found software flaws tied to the use of Anthropic’s Claude Mythos platform.
“If the customer has Mythos, their anxiety is up there. The customers [that have] not seen it, they still don't realize the insane power of what this can do. Insane power. I was scared,” Padmanabhan said, semi-jokingly adding that when she saw the power of Mythos, she went home and told her spouse that they needed to empty their bank account and put the money into gold. “And it is the kind of vulnerabilities, the network accessible vulnerabilities, the kind of exploits, even changing kernel modules, we are scared, but anybody who has not seen Mythos doesn't understand.”
Padmanabhan explained that the Tanzu team tapped Mythos to scan for 2,000 vulnerabilities across nine microservices-based applications, each of which were running in a virtual machine (VM) environment, a containerized environment, and in a Tanzu environment. The results showed those applications running in the Tanzu environment were able to cut 60% of the exploits.
That’s not to say that Broadcom is able to zap all vulnerabilities.
CrowdStrike this week claimed a China-linked hacking group exploited an insufficient logging vulnerability in VMware ESX first discovered in July. The flaw allowed attackers to bypass administrative command logging and conceal malicious activity, while malware was deployed within VMware vCenter environments.
The breaches occurred before Broadcom patched the flaws in question, which affected vCenter and associated Cloud Foundation (VCF), vSphere Foundation, and Telco Cloud services.
IBM, Red Hat Lightwell shed similar illumination #
IBM’s Red Hat division reported a similar patch push earlier this month through its $5 billion-backed Project Lightwell initiative. That program was unveiled in late May with a focus on providing a trusted clearinghouse for securing the open-source software supply chain.
That project recently identified, remediated, and backported fixes to more than 400 previously unknown vulnerabilities in widely used Java libraries.
"AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed. They do not care if a codebase is 10 years old or otherwise considered stable, because one small crack is all it takes to chain an attack together,” Gunnar Hellekson, VP and GM for Lightwell at Red Hat, noted on that latest effort. “Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime.”