Median time from patch to first recorded exploitation was 51+ days every month of 2026, RootEvidence chart shows
WeldPond · x · 2026-11-10
Security researcher jeremiahg shares a RootEvidence chart arguing that three timelines are distinct: exploit code development, first in-the-wild attempts, and first use in a breach.
The chart shows that for every month of 2026, the median time from patch release to first recorded exploitation of KEV-listed CVEs was 51+ days — February peaked at 567.5 days, October at 452 days, with most months between 90-230 days. Zero-days, unpatched CVEs, and WordPress plugins were excluded. The authors verified 431 of 813 dates against sources and note many CVEs had patches over a year old.
More from Safety
- Bloomington, Indiana passes ordinance banning superintelligence within city limits — yoavgo · 2026-11-10
- Claude Code Security Audit Uncovers Baby Monitor Streamed on Public Site — mikeflache · 2026-11-10
- Meta and Sierra Lead Working Group on AI Agent Identity Standards — mikeflache · 2026-11-10
- WEF Briefing Paper: Governing Agentic AI Systemic Risks — mikeflache · 2026-11-10
- Fable 5.2 system card shows blocked kernel dev on certain accelerators, reportedly Huawei and DeepSeek — casper_hansen_ · 2026-11-10
- Researcher's 7-bug Apple exploit chain confirmed by Apple Product Security, zero duplicates — kingslyj · 2026-11-10