What happened
Trail of Bits’ public dashboard for Patch the Planet reports the current state of the open-source vulnerability initiative. Updated on October 30, 2026, it lists 2,055 potential bugs reported across 72 codebases under review. The dashboard describes the program as moving from bugs found to patches shipped and fixes merged across projects in the initiative.
The pipeline shown on the page has four reported stages. There are 2,055 issues found; 1,376 items marked “awaiting patch,” described as reported plus confirmed; 207 fixes open upstream; and 472 patches accepted, meaning merged upstream. The accepted-fix total is therefore a count of changes that have landed in upstream projects, rather than merely reports filed or proposed patches awaiting maintainer review.
The 472 accepted fixes are categorized by severity: 78 high severity (16.5%), 234 medium (49.6%), 87 low (18.4%), 31 informational (6.6%), and 42 undetermined (8.9%). The dashboard also lists 89 assigned CVEs. Its disclosed-CVE list includes entries associated with projects such as aiohttp, containerd, cryptography, curl, Firefox/Thunderbird, Keycloak, the Linux kernel, and NATS.
The project distribution is uneven. Among the ten most-reported projects, scapy has 231 reports, crypto-bigint 205, vLLM 129, Keycloak 116, samba 89, zeek 76, ansible 73, cryptlib 73, PHP 72, and nats-server 65. A chart of reports over time identifies a daily peak of 224 on June 2 and notes that its figures include reports later closed during triage. The dashboard does not state a price, commercial access tier, or a general-purpose product interface; it offers links to apply to the initiative and to read about it.
What the archive adds
This is a new fact on a known story rather than a new event. Earlier coverage introduced Patch the Planet’s coordination model, documented the Brotli decoder RCE disclosure, and reported that 458 of 661 patches had been accepted amid maintainer concerns about report volume in the Daybreak update. The dashboard now shows 472 accepted patches and a 1,376-item awaiting-patch stage.
Trend signal
The update supports the pattern that verification bandwidth is the scarce engineering resource. Patch acceptance is an external upstream decision, while reports can be generated and triaged at much greater volume. The dashboard does not prove why items remain awaiting patch, but the visible gap between 1,376 awaiting-patch items and 472 accepted fixes makes the downstream review, implementation, and maintenance path the consequential constraint.
Why now
This is timely because the public dashboard was updated on October 30, 2026, after the earlier archive report cited 458 accepted patches. The update offers a current, initiative-wide count rather than another individual vulnerability disclosure.
Connections to other events
The figures sit alongside the earlier Brotli disclosure, where Patch the Planet’s work resulted in deployment guidance across Node.js, Bun, Envoy, Istio, and upstream Brotli. That event showed the operational value of a specific fix; the dashboard shows the broader program’s still-unresolved patch queue.
Why it matters
Teams building with AI should distinguish vulnerability discovery throughput from remediation throughput. A large number of reports, or even confirmed findings, does not itself improve software safety. A merged upstream patch is a more concrete milestone, but it still leaves downstream users to identify exposure and deploy fixed versions.
For teams using AI to find defects in their own code or dependencies, the practical implication is to design the work around the full remediation path: reproduction, severity assessment, owner assignment, patch creation, tests, maintainer review, release coordination, and deployment. Measuring only findings risks rewarding the easiest part of the workflow. The dashboard’s pipeline makes the queue visible, though it does not reveal the causes or age of each item.
What happens next
- The accepted-patch total will continue to rise, but the awaiting-patch queue will remain materially larger. (3 months, 65%). Watch for: subsequent dashboard updates showing both counts.
- More Patch the Planet findings will receive public CVE records and project-specific advisories. (6 months, 70%). Watch for: additions to the dashboard’s disclosed-CVE list.
Limits and uncertainty
The dashboard is a program-operated aggregate and does not provide a per-project disposition, time-to-triage, time-to-merge, exploitability assessment, or an explanation for the awaiting-patch backlog. “Potential bugs reported” includes reports closed during triage, so it should not be read as a count of validated vulnerabilities. The page also does not establish that AI alone found, patched, or verified every listed item, nor does it quantify the effort contributed by maintainers, researchers, or responders. CVE assignment is not equivalent to proof of active exploitation or urgent impact for every downstream user.
Skill to build now
Add a remediation dashboard to any AI-assisted security or reliability workflow. Separate counts for reports, reproduced findings, owned fixes, patches under review, merged fixes, released fixes, and deployed fixes. Assign a human owner and a due date once a finding is confirmed, and record the evidence needed for the next handoff. This makes the queue actionable instead of treating a growing number of model-generated reports as the outcome.
Reader takeaway
Patch the Planet’s October dashboard records 472 upstream-merged fixes, but also 1,376 reported-and-confirmed items awaiting patches. AI-assisted discovery can create useful security work at scale; the harder operational question is whether maintainers and teams have enough review and remediation capacity to complete it.
Open question
How many awaiting-patch items have a reproducer, an assigned owner, and a viable upstream path to merge—and how long do those stages take by project?