Under the newly introduced "Full X" framework, security flaws will now be publicly detailed precisely 90 days following initial vendor notification. The organization intends to scale this window down to 60 days in early 2027 and ultimately to 30 days in 2028. Large language models and AI tools have significantly reduced the time threat actors need to reverse engineer patches, rendering conventional soak times obsolete. To enforce consistency, most historic exceptions, grace periods, and negotiated variant terms have been fully eliminated.
Key points
Advancements in artificial intelligence allow malicious actors to uncover and weaponize s…: Advancements in artificial intelligence allow malicious actors to uncover and weaponize software vulnerabilities at vastly higher speeds.
Phased implementation schedules prevent sudden operational shock, ensuring enterprise ven…: Phased implementation schedules prevent sudden operational shock, ensuring enterprise vendors do not abandon remediation work entirely.
Simplifying disclosure policies through automation eliminates negotiated grace periods to…: Simplifying disclosure policies through automation eliminates negotiated grace periods to establish predictable security expectations.
Sources checked by our analysis pipeline: 1
Since 2021, Project Zero has followed a “90 + 30” vulnerability disclosure policy, allowing vendors up to 90 days to remediate a vulnerability plus an extra 30 days “soak time” for patch rollout. Our goal was to encourage faster patching and give vendors time to deliver patches to users. The advent of AI-assisted vulnerability discovery and exploitation has changed the threat landscape such that the vulnerability remediation timeline encouraged by our disclosure policy is clearly insufficient.
LLMs have increased the speed at which attackers can find and exploit vulnerabilities, alongside the risk that multiple parties, including malicious ones, discover the same bug. A vulnerability reported today presents a much higher immediate risk to users than one reported last year. In this new environment, it is crucial that vendors move towards remediating vulnerabilities faster.
LLMs have also decreased the time it takes for attackers to reverse engineer and exploit a vulnerability based on a patch, to the extent that zero patch-to-exploitation time is a reasonable, though imperfect, model of attacker behavior. Patch soak time is no longer meaningful in a world…
Transportation officials halted nationwide air traffic after an infrastructure upgrade triggered intense technical disruptions, overwhelming antiquated federal equipment with intermittent radar and communication gaps. The precautionary airspace shutdown left thousands of flights canceled and forced multiple diversions across the country. Recovery efforts are expected to disrupt airline operations for several days due to the interconnected nature of the nation's regional traffic centers.
Internet users face widespread surveillance and data commodification driven by state entities, tech giants, and commercial brokers. To defend fundamental digital rights against growing monitoring and censorship, robust encryption tools must be paired with anti-tracking technology. Comprehensive online protection increasingly requires moving beyond standard connection defenses to address layered browsing vulnerabilities.
Air travel is slowly returning to normal operations following an unprecedented grounding of all outbound aircraft across the country. Government officials pointed to out-of-date technology as the root cause of the crippling system failure. The resulting chaos disrupted schedules nationwide and left countless travelers stranded at airports as the network recovered.