Open source usually fixes its flaws fast. Getting the fix into your own systems is your job, and AI has just put a clock on it.
A lock maker learns that any burglar can open one of its locks. Within days, it ships a free replacement. Almost four years later, roughly one in eight locks leaving the warehouse is still the old one.
The lock is Log4j, a small piece of open source software inside countless business applications, and the flaw was made public in December 2021. Sonatype, which runs the main public warehouse for this kind of software, counted nearly 300 million downloads of it in 2025. Roughly 13% were still a version with the hole.
Why am I telling this old story? Open source is usually fast at producing a fix. Getting it into your own systems is slow, and that part is yours. Often nobody even knows the piece is there: it sits deep inside other software, and unless someone in your organization keeps track, the fix passes you by.
Many organizations treated that gap as a slow leak they could afford to ignore. This year it stopped being slow. The European Central Bank warned bank chiefs this summer that new AI models can find software flaws and build working attacks at unprecedented speed.
Banks feel it first: they hold the money, and their regulators are now counting the days. In May, the president of BaFin, Germany's financial regulator, said installing fixes used to be measured in months and in the future must be done within a few days, if not hours. The ECB wants an action plan from the largest banks it supervises by 31 October.
Two things stretch those months. One is testing and sign-off. The other is self-inflicted. FINOS, the Linux Foundation's financial services arm, cited research this month showing that inside 1 in 5 financial institutions, different teams each keep their own private, modified copy of the same open source project. Before the official fix can go in, every private copy has to be brought in line with it and tested again.
Last week in Prague, the banks' joint answer went live: OSERA, an alliance under FINOS funded by Deutsche Bank, Goldman Sachs, Morgan Stanley and other large banks. A flaw in the versions banks actually run gets fixed once, shared with every member, and offered back to the original project wherever it is still maintained. Patches for more than 50 widely used components have already shipped.
Someone who runs open source for a German public administration goes one step further. I asked whether they keep private copies. A flat no: private copies are debt that keeps growing, so every change goes back to the original project. Once the original project takes a change, every later release carries it, and an update stays an update.
The largest banks got a deadline. Plenty of companies run the same software with no deadline, and often nobody watching.
Take one question to your next IT meeting: "When a fix is published for software we run, how long until it is live in our systems, and whose name is on that?"
If nobody in the room knows, there's your honest answer: whenever someone notices.
