A new research framework called BUGSTONE-E2E mines old vulnerability fixes and turns them into automated rules for catching the same bugs elsewhere.
The system pulled data from 19,325 high-severity CVEs logged between 2022 and 2026. It extracted 2,710 actual fixing commits and used them to build 1,033 detection rules covering 56 categories of software weakness, bundled into 172 reusable "skills." Rather than throwing expensive AI analysis at every line of code, it uses a funnel: fast, cheap pattern-matching with Tree-sitter narrows a huge candidate pool first, then progressively pricier LLM-based checks inspect what's left. Run across 14 real programs, it produced runtime evidence for 644 findings.
The interesting move here isn't the bug-finding itself - static analysis tools have done that for decades. It's the reuse. Every CVE fix already contains a precise record of what was wrong and how it was corrected, but that knowledge usually just sits in a changelog, read once and forgotten. This framework treats patch history as a training set for future detection, rather than an archive.
Whether this actually reduces false positives at scale, versus existing static analyzers, is a question the paper's own benchmark numbers will need to answer over time - a few hundred findings across 14 programs is a promising pilot, not proof the approach generalizes to messy production codebases.