{"slug": "broadcom-bashes-bounty-of-novel-vulnerabilities", "title": "Broadcom bashes bounty of ‘novel vulnerabilities’", "summary": "Broadcom shipped fixes for 89 \"novel vulnerabilities\" found by AI to critical infrastructure customers and other early-access users of its TrueSource Spring Enterprise platform, ahead of public disclosure. Broadcom said TrueSource has now found and distributed fixes for 408 vulnerabilities, delivered more than 1,090 fixes, reviewed more than 2,600 reports and filtered out more than 3,000 false alarms; VP and GM Purnima Padmanabhan said a Tanzu team run using Anthropic's Claude Mythos to scan 2,000 vulnerabilities across nine microservices-based applications cut 60% of exploits in the Tanzu environment. The same week, CrowdStrike claimed a China-linked group exploited an insufficient logging flaw in VMware ESX, first discovered in July, to bypass administrative command logging and deploy malware in VMware vCenter environments, with the breaches occurring before Broadcom patched the affected vCenter and Cloud Foundation flaws.", "body_md": "Broadcom this week shipped dozens of “fixes” for AI-found vulnerabilities for select users of its TrueSource Spring Enterprise platform, a move that highlights a growing push by software platform vendors in using AI to track down and remediate rogue code.\n\nThe vendor explained that it recently shipped patches for 89 “novel vulnerabilities” that were pushed to “critical infrastructure customers and others who qualify for early access, ahead of public disclosure.” Broadcom noted it has now used its TrueSource platform to find and distribute fixes for 408 vulnerabilities, deliver more than 1,090 “fixes,” review more than 2,600 reports, and filter out more than 3,000 false alarms.\n\nBroadcom [unveiled the TrueSource platform](https://www.sdxcentral.com/news/broadcoms-vmware-bolsters-vcf-ai-foundation-agentic-security/) as part of its recent VMware Explore event, a launch that built on its move earlier this year to [bolster the Spring ecosystem supply chain security](https://www.sdxcentral.com/news/broadcom-injects-security-updates-into-spring-java-ecosystems/). The TrueSource platform encompasses Broadcom’s portfolio of enterprise open-source software, “verified by engineers and delivered from one trusted source.”\n\nBroadcom uses frontier AI models to scan for and construct patches for vulnerabilities. TrueSource Spring Enterprise customers receive immediate fixes across all supported platform versions, providing legacy releases immediate access while providing security-only patches for current versions to speed deployment. Detailed vulnerability information is then published when fixes reach the community and CVEs are issued.\n\nPurnima Padmanabhan, VP and GM for Broadcom’s Tanzu offering, earlier this year explained that TrueSource is “one brand for everything that we do to give customers secure, clean, open-source libraries and images. And that it's one neck to choke. So before they start building an application, they make sure when you're cooking this recipe, you're making sure the ingredients into that recipe are clean.”\n\nPadmanabhan added that this is increasingly important for enterprises that have been impacted by the surge in found software flaws tied to the use of [Anthropic’s Claude Mythos platform](https://www.sdxcentral.com/news/anthropic-bug-hunter-launched-with-all-star-cast-and-good-old-us-patriotism/).\n\n“If the customer has Mythos, their anxiety is up there. The customers [that have] not seen it, they still don't realize the insane power of what this can do. Insane power. I was scared,” Padmanabhan said, semi-jokingly adding that when she saw the power of Mythos, she went home and told her spouse that they needed to empty their bank account and put the money into gold. “And it is the kind of vulnerabilities, the network accessible vulnerabilities, the kind of exploits, even changing kernel modules, we are scared, but anybody who has not seen Mythos doesn't understand.”\n\nPadmanabhan explained that the Tanzu team tapped Mythos to scan for 2,000 vulnerabilities across nine microservices-based applications, each of which were running in a virtual machine (VM) environment, a containerized environment, and in a Tanzu environment. The results showed those applications running in the Tanzu environment were able to cut 60% of the exploits.\n\nThat’s not to say that Broadcom is able to zap all vulnerabilities.\n\n[CrowdStrike this week claimed](https://www.sdxcentral.com/news/vmware-vulnerability-exploited-by-china-nexus-threat/) a China-linked hacking group exploited an insufficient logging vulnerability in VMware ESX [first discovered in July](https://www.sdxcentral.com/news/vmware-users-beware-these-new-flaws-in-telecom-cloud-and-more/). The flaw allowed attackers to bypass administrative command logging and conceal malicious activity, while malware was deployed within VMware vCenter environments.\n\nThe breaches occurred before Broadcom patched the flaws in question, which affected vCenter and associated Cloud Foundation (VCF), vSphere Foundation, and Telco Cloud services.\n\n## IBM, Red Hat Lightwell shed similar illumination\n\nIBM’s Red Hat division reported a similar patch push earlier this month through its $5 billion-backed Project Lightwell initiative. That program [was unveiled in late May](https://newsroom.ibm.com/2026-05-28-ibm-and-red-hat-commit-5-billion-to-redefine-the-future-of-open-source-in-the-ai-era) with a focus on providing a trusted clearinghouse for securing the open-source software supply chain.\n\n[That project recently](https://www.redhat.com/en/about/press-releases/ibm-and-red-hat-remediate-more-400-previously-unknown-open-source-vulnerabilities) identified, remediated, and backported fixes to more than 400 previously unknown vulnerabilities in widely used Java libraries.\n\n\"AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed. They do not care if a codebase is 10 years old or otherwise considered stable, because one small crack is all it takes to chain an attack together,” Gunnar Hellekson, VP and GM for Lightwell at Red Hat, noted on that latest effort. “Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime.”", "url": "https://wpnews.pro/news/broadcom-bashes-bounty-of-novel-vulnerabilities", "canonical_source": "https://www.sdxcentral.com/news/broadcom-bashes-bounty-of-novel-vulnerabilities/", "published_at": "2026-10-30 19:13:46+00:00", "updated_at": "2026-10-30 19:19:48.217278+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "artificial-intelligence", "ai-products"], "entities": ["Broadcom", "TrueSource Spring Enterprise", "VMware", "Purnima Padmanabhan", "Tanzu", "Anthropic", "Claude Mythos", "CrowdStrike"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/broadcom-bashes-bounty-of-novel-vulnerabilities", "markdown": "https://wpnews.pro/news/broadcom-bashes-bounty-of-novel-vulnerabilities.md", "text": "https://wpnews.pro/news/broadcom-bashes-bounty-of-novel-vulnerabilities.txt", "jsonld": "https://wpnews.pro/news/broadcom-bashes-bounty-of-novel-vulnerabilities.jsonld"}}