J.P. Morgan’s Patchmageddon: Time-to-Exploit Hits Zero Days While Time-to-Patch Nears 100, 18 Million Packages Have One Maintainer, and Only 75 of 530 High-Severity Mythos Findings Got Fixed

The time between a vulnerability’s disclosure and its first exploitation has fallen to zero days while the average organization’s time to patch has risen toward 100, and frontier models that find bugs at scale push both lines the wrong way. The exposed flank is open source: 18 million packages with one maintainer, a two-week patch lag on Mythos findings, and only 75 of 530 high-severity bugs reported to maintainers actually fixed. The report’s answer is to measure companies on speed as well as accuracy, lean on the same models for remediation, and treat unpatchable industrial networks as a policy problem, not an IT one.

Original: Patchmageddon: The race to patch software vulnerabilities before zero-day cyber-exploitations proliferate by Michael Cembalest, J.P. Morgan Eye on the Market, July 22, 2026. (PDF)

Summarized by AI.