How to fix a bug in a fix

Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some vendors express concern about potential scenarios in which they are unable to fix vulnerabilities that are causing immediate user harm, due to limitations in their patch delivery systems. Since Project Zero encounters a wide array of systems designed to protect users in the case of exceptional exploitation scenarios, both through vendor discussions and security reviews, we want to share what we’ve learned. This post provides an overview of systems in use by large vendors that allow them to remediate small volumes of vulnerabilities much faster than their typical update process. Our goal is to provide a reference for vendors seeking to implement or enhance the capabilities of such systems, and to encourage vendors to consider how they would fix an urgent vulnerability before they receive one.

The report describes emergency patching systems that help software vendors remediate urgent vulnerabilities faster than standard update processes, including mechanisms such as feature flags, filtering, alternate update channels, and hotpatching. It does not specifically report an AI vulnerability or AI incident. RealGround analysis: the guidance is indirectly relevant to organizations operating AI software supply chains because rapid, controlled remediation capabilities can reduce exposure when critical vulnerabilities affect AI components or dependencies.