NOVA: 14,090 critical vulnerabilities discovered in two months with cutting-edge AI

NOVA: A New Paradigm in Vulnerability Discovery

Frontier AI is revolutionizing the cybersecurity landscape, accelerating both vulnerability discovery and exploitation. Palo Alto Networks' vulnerability research team has developed an autonomous system for vulnerability discovery, validation, and reporting called Network and Open-Source Vulnerability Analyzer (NOVA). This system leverages advanced AI models to analyze open-source software projects and identify previously unknown vulnerabilities.

Extraordinary Results in Just Two Months

In just two months, NOVA analyzed 3,915 open-source software projects and discovered 14,090 confirmed vulnerabilities. Of these, 99.4% had never been reported before, and 40% were classified as high or critical severity. These results underscore the dramatic impact of AI on the vulnerability landscape.

Collaboration with the Open-Source Community

In response to these significant results, Palo Alto Networks is actively collaborating with open-source software maintainers and reporting platforms like Lightwell and Akrites to responsibly disclose these vulnerabilities and ensure they are quickly and safely fixed. Open-source supply chain security is fundamental to protecting the entire software ecosystem.

The Patch Window is Shrinking

The experience with NOVA highlights a clear structural change: the patch window is shrinking. With the acceleration of vulnerability discovery, the time between disclosure and potential exploitation is drastically reduced. Attackers do not need access to the most advanced AI models to reverse-engineer patches and automatically develop exploits.

Virtual Patching: An Essential Defensive Strategy

This new reality makes virtual patching an even more important defensive strategy in the AI era. Palo Alto Networks recently announced the [Advanced Virtual Patching](https://www.paloaltonetworks.com/blog/2026/08/redefining-network-security-for-the-frontier-ai-era/?utmcampaign=CeresBlog&utmsource=linkedin&utmmedium=socialExecs&utmcontent=1785845183), designed to operate at the speed of AI and keep pace with the increasing discovery of vulnerabilities and compressed attack windows. This technology enables reducing the exposure window from an average of 55 days to nearly zero.

Best Practices for Organizations

In addition to the protections available with Palo Alto Networks' security platform, organizations are advised to implement relevant best practices, including vulnerability management, zero-trust network architecture, software supply chain security, and other attack surface reduction practices.

NOVA: A Fully Automated Vulnerability Discovery System

The vulnerability research team has developed a fully autonomous vulnerability discovery system that only requires human intervention in the final review phase. NOVA performs the following functions for each project analyzed:

• Reviewing the project history
• Reading the source code
• Identifying vulnerable candidates
• Creating a working proof of concept (PoC)
• Deterministic validation of whether the vulnerability is triggered in a clean environment
• Producing a disclosure report

The pipeline scanned 3,915 projects in six major software ecosystems, producing results in every ecosystem tested, for a total of 14,090 new vulnerabilities.

Vulnerability Distribution by Ecosystem

The results are distributed differently across various software ecosystems:

• PHP, Java/JVM, and C/C++ include many larger web platforms, enterprise servers, and system software projects, which have produced dense clusters of results per project.
• Go and JavaScript/TypeScript include broad scans of package ecosystems, where each individual package often produced fewer results but could still impact many downstream products.

In other words, both large applications and small dependencies matter, but for different reasons. One counts due to the direct exposed attack surface, and the other due to supply chain reach.

Types of Vulnerabilities Discovered by AI

Automation for vulnerability discovery is not new, but the scale and speed of AI-driven discovery are unprecedented. Some key types of vulnerabilities identified include:

• Injection flaws
• Broken authentication
• Sensitive data exposure
• XML external entities (XXE)
• Broken access control

In particular, web application developers using languages like PHP and JavaScript will need to pay attention to code injection and prototype pollution issues, while system software developers in C/C++ will need to focus on memory safety defects.

The Role of Standardization Organizations

Organizations like OWASP and CVE are facing new challenges in classifying and managing vulnerabilities. The exponential increase in reports requires a review of their current processes to ensure that the most critical vulnerabilities are identified and communicated promptly. Additionally, new standards may need to be developed for assessing and categorizing AI-discovered vulnerabilities.

Ethical and Responsibility Considerations

The use of automated systems like NOVA raises important ethical questions. On one hand, automation can improve software security at scale, but on the other, it could also create technological dependencies that might be misused. It is crucial to establish clear guidelines for the responsible use of these technologies, ensuring that the benefits outweigh the potential risks.

The Future of Work in Cybersecurity

The automation of vulnerability discovery is also changing the skills landscape in cybersecurity. While some repetitive tasks may be automated, human skills remain crucial for contextual assessment, maintainer relations, and strategic decision-making. Organizations will need to invest in continuous training for their employees to adapt to this new reality.

International Collaboration

The global nature of open-source software requires international collaboration to effectively address discovered vulnerabilities. Initiatives like the Global Cybersecurity Action Alliance are promoting cooperation between governments, companies, and technical communities to develop coordinated threat response strategies. This collaboration is essential to ensure that solutions are scalable and applicable globally.

Implications for End Users

End users, often unaware of the technical details of vulnerabilities, will need to be educated about the importance of regularly updating their software and adopting basic cybersecurity practices. Cybersecurity companies and software providers must work together to simplify the update processes and clearly communicate the risks associated with unpatched vulnerabilities.

The advent of systems like NOVA represents a turning point in cybersecurity. While automation offers enormous advantages in terms of efficiency and coverage, it also requires significant adaptation from all stakeholders. The key to future success lies in collaboration, innovation, and a proactive approach to vulnerability management. Only through shared commitment will it be possible to build a more secure and resilient software ecosystem.