Endor Labs Launches AURI Fix to Close the Gap Between AI Vulnerability Discovery and ...

Endor Labs research finds 82% of reachable open source vulnerabilities can be mitigated with a small change to application code, compared with fewer than 10% through upgrades or patches.

PALO ALTO, Calif., Oct. 27, 2026 /PRNewswire/ -- Endor Labs , the leader in agentic development security, today announced AURI Fix for Open Source. This new capability in AURI by Endor Labs brings every open source remediation option under a single autonomous remediation engine, enabling security teams to find and apply the fastest, safest fix for vulnerabilities in open source dependencies. It also introduces a groundbreaking new method that makes targeted changes to first-party application code, breaking the exploitable path without modifying the vulnerable dependency.

The launch comes one week after the clearest sign yet that the "Vulnpocalypse" has arrived. On Oct. 21, PHP shipped emergency patches for two critical flaws impacting roughly 70% of websites. As exploitation attempts began within hours, the EU's cybersecurity agency warned that websites may need to go offline, and governments from Germany to Japan pulled public sites while they patched.

Additionally, earlier this year, JPMorgan's research found that vulnerability discovery was outpacing remediation by 16.5x, and this month the IMF identified cybersecurity incidents at banks as a leading threat to global financial stability. As increasingly capable AI models speed up vulnerability discovery, organizations face growing pressure to close remediation gaps despite limited resources, complex software dependencies and shrinking time to respond. CISOs need a way to reduce exposure quickly without destabilizing business-critical applications.

"AI has changed the equation on vulnerability management. Discovery is now nearly instant, and the old ways of fixing open source risk can't keep up," said Varun Badhwar, CEO and co-founder of Endor Labs. "Organizations shouldn't have to throw thousands of engineers or millions in AI tokens at the problem just to keep pace with what AI finds. Most of the time, the fastest and safest fix isn't in the dependency at all. It's a few lines in the code your developers already own. AURI Fix finds that path, closes it and ships the evidence to prove it, so teams can fix a reachable vulnerability the same day they find it."

Endor Labs' research team assessed 264,643 reachable vulnerabilities in enterprise codebases across financial services, insurance, cybersecurity and software companies. Less than 10% could be fixed by upgrading or patching the dependency, while 82% could be mitigated with a small change in the application code developers regularly review and maintain, without touching the dependency.

AURI Fix for Open Source evaluates every reachable vulnerability against the code context graph of a customer's application and recommends the fastest, least disruptive fix that demonstrably removes the risk:

Accept unreachable risk: AURI checks reachability, exploitability, severity and deployment context, and documents findings that pose no real risk.

Accept unreachable risk: AURI checks reachability, exploitability, severity and deployment context, and documents findings that pose no real risk.

Upgrade the dependency: Where an upgrade won't break the application, AURI finds the minimum safe version and opens a pull request.

Upgrade the dependency: Where an upgrade won't break the application, AURI finds the minimum safe version and opens a pull request.

Mitigate in code: When exposure runs through configuration or the application code, AURI applies a targeted fix, typically fewer than 10 lines

Mitigate in code: When exposure runs through configuration or the application code, AURI applies a targeted fix, typically fewer than 10 lines

Patch the dependency: For pinned versions, breaking APIs or vulnerabilities with no upstream fix, AURI applies a backported or zero-day patch.

Patch the dependency: For pinned versions, breaking APIs or vulnerabilities with no upstream fix, AURI applies a backported or zero-day patch.

Replace risky dependencies: For unmaintained or repeatedly vulnerable packages, Endor Scores help teams swap in an alternative or remove the dependency.

Replace risky dependencies: For unmaintained or repeatedly vulnerable packages, Endor Scores help teams swap in an alternative or remove the dependency.

Teams can trigger fixes from the Endor Labs CLI with endorctl fix and put them into production through policy-based workflows, in which the Endor Labs policy engine opens a pull request for review, or agentic workflows, in which an AURI agent triages findings, chooses the remediation method, applies the fix and opens a pull request for approval.

Every fix ships with a VEX report recording why the vulnerability is no longer exploitable, giving downstream scanners, customers and auditors evidence to suppress the finding, a growing requirement under regulations such as the EU Cyber Resilience Act and FedRAMP.

Endor Labs is the agentic application security platform for teams that refuse to compromise between speed and security. Endor Labs helps teams identify, prioritize, and fix vulnerabilities across code, open-source dependencies, and container images. With agentic reasoning, deep program analysis, automated remediation, and unmatched coverage, Endor Labs empowers modern engineering and security teams to move fast without compromise.

Media Sarah Graham [email protected]

View original content: