Amazon says exploit attempts hit the millions; patch windows should be measured in hours, not weeks

Cloudflare has since seen exploit attempts climb into the millions, and proof-of-concept exploits surfaced within hours of disclosure. The bugs had sat in PHP's code for years until an OpenAI-funded August audit proved they were exploitable.

Moses argues the defense playbook has to change: AI-assisted analysis makes it cheap to turn a patch diff into a working exploit, so the 7- and 30-day remediation windows assume a delay attackers no longer give. Patch timelines, he says, should be measured in hours.