Which Code Vulnerabilities Actually Get Fixed? New Code Security Data from 50,000+ Repos

Summary: Semgrep's Remediation at Scale report analyzed anonymized remediation patterns across 50,000+ repositories and hundreds of organizations in 2025, splitting them into a top-15% "leaders" cohort and an 85% "field" cohort. The largest gap appeared in Authentication Failures (A07) at 48 percentage points, with leaders fixing nearly 60% versus roughly 12% for the field, while SSRF (A10) was one of the only categories where the field slightly outperformed leaders.
What you should know: Findings open for more than 90 days become unlikely to ever be fixed: only 9% of high-performing teams' SAST remediations come from the 90+ day backlog, versus 16% for the field. One organization fixes 63% of its critical findings and another fixes 13% with the same tools and the same alerts.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026