Most security vulnerabilities take years to see the light of day

Lock
(Image credit: Shutterstock)

Many security vulnerabilites take a seriously long time to be fully disclosed, putting businesses and users alike at risk of further attack, new research has revealed.

With over 56 million developers, GitHub is the world’s largest platform for open source developers, and as part of its annual Octoverse survey, the platform discovered that a vulnerability usually goes undetected for about 218 weeks.

That’s just over four years, and while it might sound like a lot, GitHub points to the RAND report on zero-day vulnerabilities, which discovered that exploits surviving for five years before being publicly discovered and disclosed, wasn’t unheard of.

The open source community is better placed, as GitHub discovered that over 80% of the CVEs it sends alerts for “are due to mistakes rather than malicious intent.” Even then the GitHub report points out that once a vulnerability has been identified it doesn’t take long for the community to release a fix.

Securing the supply chain

GitHub has been very vocal about securing the open source supply chain, noting that, “94% of projects rely on open source components, with nearly 700 dependencies...so when there’s a problem with security in the supply chain, you see a massive ripple effect.” 

The platform has launched security scanning tools and is also part of a new industry-wide collective to help mitigate security risks that are inherent to the open source style of development.

It reaffirms its position in the Octoverse report saying that the security findings “highlights the opportunities to improve vulnerability detection in the security community. The key is to leverage automated alerting and patching tools to secure your software quickly.”

Octoverse is the annual survey that GitHub conducts among its large cache of projects and developers in a bid to get the pulse of the community. In addition to security, the report also looks into developer productivity, and how collaboration and development patterns have shaped in light of the global pandemic.

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
Opera AI Tabs
Opera's new AI feature brings order to your browser tab chaos
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead
EA Sports F1 25 promotional image featuring drivers Oscar Piastri, Carlos Sainz and Oliver Bearman.
F1 25 has been officially announced, with this year's entry marking a return for Braking Point and a 'significant overhaul' for My Team mode