Broadcom Korea Flags Neglected Open Source Flaws as AI Targets
At AIS 2026 in Seoul, a Broadcom Korea director said Spring and RabbitMQ CVE counts jumped sharply in 2026 as AI tools speed up exploitation.
Lee Yo-han, a director at Broadcom Korea, said neglected open source vulnerabilities have become a prime target for AI-driven hacking, in a talk at the 2026 AI Security Conference (AIS 2026) held in Seoul on November 3. The session was titled "Neglected Vulnerabilities, the Perfect Target for AI Hacking: Spring, OSS, Infrastructure," according to Daily Security, which hosted the event.
Lee said more than 75% of a typical enterprise codebase consists of open source frameworks and libraries. He pointed to Spring, which had 157 CVEs published from 2013 to 2025, but 211 published between March and August 2026 alone. RabbitMQ recorded 8 cumulative vulnerabilities through 2025, against 112 published between May and October 2026.
He also cited that more than 60% of Spring Boot downloads are versions that have already reached end of support. On AI's role in patching, Lee referenced Off-by-1 Labs (1Password) research in which two frontier models made 6,080 patch attempts on six major vulnerabilities, with 17% rated as sustainable fixes.
Lee recommended identifying components through SBOM and SCA, renewing key frameworks and runtimes such as Spring, Java, Tomcat, NGINX and PostgreSQL, and applying microsegmentation and virtual patching. He introduced Broadcom's TrueSource portfolio and VMware vDefend as tools that support these responses.
AIS 2026 was sponsored by KISA and KISIA, with about 700 security staff and related personnel attending.
Quick answers
What did Broadcom Korea's Lee Yo-han discuss at AIS 2026?
He spoke on neglected open source vulnerabilities as targets for AI hacking, covering Spring, RabbitMQ and infrastructure, and recommended SBOM, SCA, runtime renewal and virtual patching.
How many CVEs did Lee say Spring and RabbitMQ recorded in 2026?
Lee said Spring had 211 CVEs published between March and August 2026, and RabbitMQ had 112 between May and October 2026.
What did the Off-by-1 Labs research cited by Lee find?
Two frontier models made 6,080 patch attempts on six major vulnerabilities, with 17% rated as sustainable fixes.