Published: [October 30, 2026]
StartupFeed Quick Take
- AI found 14,090 open source flaws in 3,915 projects in two months. Only 85 were already public.
- CERT-In gives Indian firms 12 hours to contain an exploited internet-facing flaw. High-severity flaws get five days.
- The industry takes 55 days to ship a patch. That is 110 times the 12-hour window.
Palo Alto Networks pointed AI at 3,915 open source projects and found 14,090 security flaws in under two months.
Its Unit 42 research team published the count on August 4, 2026, after running the scan across six language groups. Only 85 of those findings were already in public vulnerability records. That is 0.6%.
The split works out to 3.6 flaws for every project scanned, a sum StartupFeed did from the two published totals.
Nearly all of it was new. The research puts 99.4% of the 14,090 flaws outside any public report at the time of discovery.
AI Found 14,090 Open Source Flaws in Two Months
The system is called NOVA, short for Network and Open-Source Vulnerability Analyzer. It reads a project’s code, builds a working proof of concept, and tests that proof in a clean environment.
Severity was not low. Under the CVSS 4.0 standard, 5,600 of the findings, or 39.7%, scored high or critical.
CVSS means the Common Vulnerability Scoring System. It is the standard the security industry uses to rate how badly a flaw can hurt you.
Some flaws travel further than others. The run produced 5,421 supply chain findings, and 1,280 of those sat inside dependency packages. Those 1,280 opened 4,141 paths into applications that pull them in.
Google’s Mandiant team ran a similar system over stolen company code in August and found more than 100 confirmed critical flaws in two days.
Lee Klarich, who runs product at Palo Alto Networks, named the real problem when the company announced a defence programme on August 19:
“Protecting critical infrastructure requires a structural shift from isolated patching to collective, proactive intelligence.”
Lee Klarich, chief product officer, Palo Alto Networks. From the company statement, August 19, 2026.
CERT-In Gives Indian Firms 12 Hours to Fix the Worst Ones
India already has the rule written down. CERT-In published a 38-page blueprint on May 25, 2026 that sets patching deadlines by how exposed a system is.
The tightest deadline is 12 hours. It covers a known exploited flaw sitting on a system that faces the open internet.
| Type of flaw | Where it sits | CERT-In deadline |
|---|---|---|
| Known exploited | Facing the internet | 12 hours |
| Critical | Facing the internet | 1 day |
| Known exploited | Internal | 1 day |
| Critical | Internal, high-value system | 3 days |
| High severity | Any, by risk order | 5 days |
The blueprint sits on top of an older duty. CERT-In’s directions of April 28, 2022 give an Indian company six hours to report a listed incident after noticing it.
Those same directions also ask for 180 days of logs kept on servers inside India. They apply to a two-person startup exactly as they apply to a bank.
Palo Alto Networks puts the industry average at 55 days to build, test and deploy a normal patch. Set 55 days against a 12-hour window and the gap is 110 times.
Attackers Started Stealing Data Four Minutes After Breaking In
The speed is real. CrowdStrike’s 2026 legal threat report, released on October 28, 2026, describes an intrusion where data theft began four minutes after the attacker got in.
Four minutes against a six-hour reporting clock leaves a gap of 90 times. The attacker is finished long before the form is filled.
Extortion volume rose with it. The report counts 455 legal entities named on data leak sites between September 2025 and August 2026, up 39% in a year.
Law firms are not startups. The pattern is the same though: code is read, data is taken, and a leak site is used to squeeze a payment.
Indian startups sit squarely on that path. Most of them ship products built on the same Go, JavaScript and PHP packages NOVA scanned.
Those three language groups carried most of the findings. Go produced 3,281, JavaScript and TypeScript 2,836, and PHP 2,740.
What a Small Indian Team Can Check This Week
Start with what faces the internet. CERT-In’s own first phase asks for that list, plus multi-factor login, inside the first seven days.
Then build a list of what you ship. You cannot patch a package in 12 hours if you do not know it is in your product. A software bill of materials is the plain name for that list.
Write the six-hour report before you need it. A half-filled form sent on time beats a perfect one sent two days late.
Decide now who files it. The 2022 directions ask every covered organisation to name a single point of contact for CERT-In.
Keep 180 days of logs on Indian servers, and sync your clocks to an Indian time source. Most cloud defaults do neither.
None of this needs a large budget. It needs one owner and one list.
What this means for you: If you run an Indian startup with any server facing the internet, CERT-In’s 12-hour window already applies to you. List your internet-facing systems and your open source dependencies this week, and name the one person who files the six-hour report.
StartupFeed Insight
The headline number is nearly three months old, and that is exactly the point. NOVA found 14,090 flaws in two months, and 99.4% of them were new to the public record. Patches are still moving through thousands of open source projects, so the exposure is live today, not in August. Indian startups will not be judged on whether they read the research. They will be judged on one answer when CERT-In asks: which systems face the internet, and what is inside them? Expect that question to show up in audits before March 2027.
By Saraswati Chaubey, Writer
Have a tip? Write to us at editorial@startupfeed.in.
Liked this story? Follow StartupFeed on Google so our reporting reaches you first.
