Endor Labs has introduced AURI Fix for Open Source, a capability that consolidates open source remediation options into a single autonomous engine and enables security teams to address vulnerabilities through dependency updates, patches or targeted changes to application code.

The new capability is part of AURI by Endor Labs and evaluates vulnerabilities in the context of an application's code to recommend fixes intended to reduce risk while minimizing disruption. It can also make targeted changes to first-party application code to break an exploitable path without modifying the vulnerable dependency.

The announcement comes amid growing pressure on organizations to remediate vulnerabilities as AI accelerates their discovery. On Oct. 21, PHP shipped emergency patches for two critical vulnerabilities affecting roughly 70% of websites. Exploitation attempts began within hours and the European Union's cybersecurity agency warned that websites might need to go offline while patches were applied.

Research from JPMorgan earlier this year found that vulnerability discovery was outpacing remediation by 16.5 times. The International Monetary Fund also identified cybersecurity incidents at banks as a leading threat to global financial stability in its October report.

"AI has changed the equation on vulnerability management. Discovery is now nearly instant, and the old ways of fixing open source risk can't keep up," said Varun Badhwar, CEO and co-founder of Endor Labs.

Badhwar said organizations need ways to address vulnerabilities without dedicating thousands of engineers or millions of AI tokens to remediation. He added that targeted changes to application code can sometimes provide a faster and safer fix than modifying a vulnerable dependency.

Endor Labs' research team assessed 264,643 reachable vulnerabilities in enterprise codebases across financial services, insurance, cybersecurity and software companies. Less than 10% could be addressed by upgrading or patching the dependency, while 82% could be mitigated through small changes to application code that developers regularly review and maintain.

Evaluating remediation options

AURI Fix for Open Source evaluates each reachable vulnerability against the code context graph of a customer's application to recommend the fastest, least disruptive fix that removes the risk.

When a vulnerability is not exploitable in the application's deployment context, AURI can document the finding as an accepted unreachable risk after evaluating reachability, exploitability and severity. If a dependency upgrade is appropriate and will not break the application, the platform identifies the minimum safe version and opens a pull request.

For vulnerabilities that can be addressed through configuration or application code, AURI applies a targeted mitigation that typically involves fewer than 10 lines of code. When a dependency cannot be upgraded because of pinned versions, breaking APIs or the absence of an upstream fix, the platform can instead apply a backported or zero-day patch.

AURI Fix also helps teams address dependencies that are unmaintained or repeatedly vulnerable. Using Endor Scores, teams can identify alternatives or remove the dependency altogether.

Teams can initiate fixes through the Endor Labs command-line interface using endorctl fix. Remediation can then proceed through policy-based workflows, in which the Endor Labs policy engine opens a pull request for review, or agentic workflows, in which an AURI agent triages findings, selects a remediation method, applies the fix and opens a pull request for approval.

Remediation evidence for security teams

Each fix includes a Vulnerability Exploitability eXchange (VEX) report documenting why the vulnerability is no longer exploitable. The report provides downstream scanners, customers and auditors with evidence to suppress the finding.

According to Endor Labs, this documentation addresses a growing requirement under regulations such as the EU Cyber Resilience Act and FedRAMP.

Through AURI Fix for Open Source, Endor Labs aims to help security teams close remediation gaps by selecting fixes based on application context and providing evidence that vulnerabilities have been addressed.