Tag: patching
-
A security fix with no backport is a new security problem
The cause isn’t secrecy or ignorance but maintenance maturity: backporting is manual, small teams spend their time on features, and many maintainers judge cutting a patch release to cost more than leaving users exposed. Josh Bressers draws the bigger conclusion: AI has made finding vulnerabilities nearly free while fixing them is as expensive as ever,…
-
J.P. Morgan’s Patchmageddon: Time-to-Exploit Hits Zero Days While Time-to-Patch Nears 100, 18 Million Packages Have One Maintainer, and Only 75 of 530 High-Severity Mythos Findings Got Fixed
The time between a vulnerability’s disclosure and its first exploitation has fallen to zero days while the average organization’s time to patch has risen toward 100, and frontier models that find bugs at scale push both lines the wrong way. The exposed flank is open source: 18 million packages with one maintainer, a two-week patch…