Policy and Disclosure: 2020 Edition

Summary: Project Zero announced that starting January 1, 2020, it will hold all vulnerability details until Day 90 regardless of when a vendor fixes the bug, replacing its prior practice of disclosing at patch time or at researcher discretion. The team said 97.7% of its reports are now fixed within the 90-day deadline, up from some issues taking upwards of six months to fix around 2014, and it will trial the new policy for 12 months before deciding on a long-term change.
What you should know: The policy adds two goals beyond faster patching - thorough patch development and improved patch adoption - and gives vendors the full 90 days for root cause and variant analysis, on the argument that a quick fix that papers over the cracks lets attackers revive exploits with minor changes.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026