Unit 42 Says AI System Found 14,090 Open-Source Vulnerabilities

Security researchers at Unit 42 say an autonomous research system found 14,090 vulnerabilities across 3,915 open-source projects during a two-month scanning campaign. Published on 4 August 2026, the report says 99.4% of the findings were not present in public vulnerability records when checked. Under Common Vulnerability Scoring System version 4.0, 5,600 findings, or 39.7%, were classified as high or critical severity.

The system, called Network and Open-Source Vulnerability Analyzer, or NOVA, reviewed project histories and source code, identified vulnerability candidates, generated proofs of concept, replayed findings in clean environments, proposed patches, and prepared disclosure reports. Unit 42 describes the process as autonomous until final human review. The pipeline examined 3,915 projects across six broad language and software ecosystems, including 17 PHP projects that produced 2,740 findings, but the report does not name those projects or publish project-level results.

Unit 42 says the results extend automated security research beyond bug classes traditionally associated with fuzzing. Memory and calculation issues, resource-management flaws, and denial-of-service findings together accounted for 8% of the total, leaving 92% in other categories. Recurring classes included access-control and authorisation failures, path traversal, code injection, prototype pollution, and server-side request forgery.

The research also reports 5,421 supply-chain findings across the package ecosystems examined. These comprised 1,280 flaws in dependency packages and 4,141 downstream exposures where applications could reach vulnerable dependencies through their own code. Unit 42 says NOVA validated exploitability from the downstream application with a working proof of concept in 2,776 of those exposures.

For Drupal teams, the findings provide broader evidence of how autonomous vulnerability discovery could increase the volume and speed of security reports affecting open-source applications and their dependencies. Drupal is a PHP-based platform, but the presence of PHP projects in the dataset does not establish that Drupal core, contributed projects, or software used by Drupal sites was scanned. Unit 42 does not identify Drupal anywhere in its published project results.