Tag
A cybersecurity blogger argues the current wave of 0-days, broken disclosure embargoes, and overwhelmed defenders is unsustainable, warning that AI cannot solve the patch-management bottleneck for operations teams.
OpenAI led a coalition to disclose critical PHP vulnerabilities first discovered by GPT-5.6 Sol, sharing a PHP version checker and a proposed global response framework while committing $1B in subsidized Daybreak access for frontline defenders.
Mozilla is requiring that Firefox security tests be kept private as a separate patch until at least a week after a security fix ships, in response to improving AI capabilities that could aid exploit development.
Project Zero shares guidance on how large vendors build emergency patch delivery systems that can remediate critical vulnerabilities much faster than their normal update pipelines, covering triage, testing, delivery, and activation challenges.
The article proposes a new severity model for vulnerability reporting based on collision counts and the presence of working exploits, arguing that the current disclosure model is broken and that patches should be prioritized when multiple researchers find the same bug or exploits are public.