博通为TrueSource Spring Enterprise推送89个新漏洞修复：新增Hub与应用顾问工具
博通（Broadcom，纳斯达克代码：AVGO）10月27日宣布，已为其 TrueSource Spring Enterprise 平台推送89个新发现漏洞的修复，并率先向关键基础设施客户与早期访问客户提供，同时推出 TrueSource Hub 与 Application Advisor 两款新工具，帮助企业评估应用风险敞口并自动生成补丁更新请求。（GSM 据博通公司新闻稿报道）
博通介绍，新上线的 TrueSource Hub 可帮助客户评估自身应用的暴露面、按优先级排列关键修复并跟踪修复状态；Application Advisor 则以 Maven 与 Gradle 构建插件的形式，在开发人员现有的工作流内自动应用补丁并生成更新拉取请求（PR）。公司称，前沿人工智能扫描使其能在开源代码公开披露前发现并修复风险，并坚持所有受支持版本同时发布修复。
TrueSource 是博通面向 Spring 开源生态的企业级支持计划，源于今年6月公司对 Spring 项目扩大投入的承诺，涵盖 Spring Boot、Spring Cloud、Spring Data、Spring Security 等全系列 SKU。博通称，其工程师在2026年内已修复406个新漏洞、交付1090多个修复（含798个回移植修复）、审查2600多份报告并过滤3000多个误报；今年6月，一个 Spring 远程代码执行漏洞（CVE-2026-41855，CVSS 评分8.1）曾通过 TrueSource 在四条受支持版本线上同步修复。
Broadcom Ships 89 Novel Vulnerability Fixes for TrueSource Spring Enterprise, Adds Hub and Application Advisor
Broadcom (Nasdaq: AVGO) announced on October 27 that it has shipped fixes for 89 novel vulnerabilities in its TrueSource Spring Enterprise platform, delivered first to critical infrastructure customers and early access customers, and launched two new tools, TrueSource Hub and Application Advisor, to help enterprises assess application exposure and automate patch updates. (GSM, based on a Broadcom press release)
According to Broadcom, TrueSource Hub helps customers assess their application exposure, prioritize critical fixes and track remediation status, while Application Advisor, available as Maven and Gradle build plugins, automates patching inside developers' existing workflows and generates update pull requests. The company said its Frontier AI scanning lets it find and fix risk before it is disclosed in public open source, and that fixes are released across all supported versions simultaneously.
TrueSource is Broadcom's enterprise support program for the Spring open source ecosystem, growing out of the company's expanded investment in the Spring project announced in June, and covers SKUs across Spring Boot, Spring Cloud, Spring Data, Spring Security and more. Broadcom said its engineers have fixed 406 novel vulnerabilities in 2026, delivered over 1,090 fixes including 798 backports, reviewed more than 2,600 reports and filtered more than 3,000 false alarms; in June, a Spring remote code execution vulnerability, CVE-2026-41855 with a CVSS score of 8.1, was fixed simultaneously across four supported release lines through TrueSource.
来源：GSM·美国（原文链接）
图片来源：图：博通生产的网络芯片特写（资料图）。照片：CC BY-SA 4.0，经 Wikimedia Commons。Photo: Close-up of a Broadcom network chip (file photo). CC BY-SA 4.0, via Wikimedia Commons.
