The Silent Patch Gap: When OSS Fix Commits Beat Security Advisories

94% of CVEs have a public fix commit before the official advisory is published. The median gap between the fix commit and the advisory is 11 days, and AI agents can now exploit that window in minutes.

Read the full research