A patch-speed leaderboard tracks how fast vendors fix security flaws. Cybersecurity news for the week of October 12–18, 2026: who patched in 48 hours, who took weeks.
Cybersecurity news rarely names which vendors patch fastest — so this weekly leaderboard does. For the week of October 12–18, 2026, we track time-to-patch across vendors: who shipped fixes within 48 hours, who took weeks, and who is still silent. Slow patching is a vendor-selection signal: every extra day is a day attackers have exploits. Use the leaderboard in procurement — ask laggards why they are slow before you renew.
A patch-speed leaderboard ranks vendors by how fast they ship security fixes after disclosure. It turns patch responsiveness — usually invisible — into a comparable, procurement-ready metric.
Eight vendors, one question: how many days did attackers get? This week's board covers the October CVE pileup — four same-day patches, one incomplete patch, one 12-day zero-day, and one flaw that was open for two years. Updated every week; every date sourced. Check your own stack with a free CVE checker while you're here.
Unauthenticated root RCE in Secure Email Gateway via crafted email attachment. Advisory and fixed Content Scanner Tools 25.3.0.5525 landed October 14 — same day, no restart required. Added to CISA KEV the same day with a federal deadline of October 17.
0 days (disclosure Oct 14 → patch Oct 14)Exploited in wild: yesSources: Pacific Technology Group · Help Net Security
Authenticated code injection in the PAN-OS management interface → root on PA-Series, VM-Series, and Panorama. Advisory and fixed releases (12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 and hotfixes per branch) shipped October 14, the same day. KEV-listed the same day; federal deadline October 17.
0 days (disclosure Oct 14 → patch Oct 14)Exploited in wild: limitedSources: BleepingComputer · Cyber Experts
CVSS 10.0 unauthenticated RCE in the CI/CD regex compiler. Patch shipped October 12 (19.2.8 / 19.3.5 / 19.4.2) with the same-day advisory — before the public PoC on October 13. Censys still counted 25,766 internet-facing hosts on vulnerable versions after disclosure.
0 days (disclosure Oct 12 → patch Oct 12)PoC public Oct 13The flaw let an attacker inherit your Docker Hub tokens by converting an account into an organization — open from August 2024 to September 30, 2026. But once reported, Docker shipped the server-side fix in under four hours — the fastest response on this board. The asterisk: attackers had two years of runway before anyone noticed.
0 days from report~2 years exposed before reportSource: Docker GhostPat check (mirror)
Auth bypass chained with command injection → unauthenticated SYSTEM on AhsayCBS backup consoles. First exploited October 7; Huntress disclosed the chain October 8. Ahsay's August releases (v9.15.2.59, v10.3.4.0) did not fully fix the flaws — the real fixes only arrived October 15 as hotfixes v10.3.4.45 and v9.15.2.70, which Huntress independently verified. KEV-listed October 14; federal deadline October 17.
7 days (disclosure Oct 8 → real fix Oct 15)Exploited since Oct 7Incomplete first patchSources: The Hacker News · Decryption Digest
Authentication bypass in Ivanti Connect Secure VPN, chained for unauthenticated root code execution. Volexity found intrusions began October 3; Ivanti patched October 13 — roughly 10 days of active exploitation before a fix, during which attackers looted AD credentials, BitLocker keys, and LAPS passwords. A third flaw in the chain remained unpatched at disclosure.
0 days from disclosure~10 days exploited before patchChain incomplete at patchSource: CVETodo
Session fixation → RCE chained with local privilege escalation → root — the chain an agentic AI used to breach DIVD on September 21. Disclosure in late September; Zammad hardened the RCE entry point in 7.2.0 but the root LPE had no patch as of October 1, addressed only in 7.2.2. Half the chain fixed, half pending — defenders had to choose between upgrading and going offline.
~5 days to partial fixNo patch for LPE half at disclosureSources: SecurityOnline · Tech Times · HackRead
CVSS 9.8 unauthenticated arbitrary file write in FortiMail's IBE handler, confirmed exploited as a zero-day. Fortinet disclosed it October 1 with no patch available — only a workaround (disable IBE). Fixed builds (8.0.2, 7.6.7, 7.4.9) only shipped October 13: 12 days of confirmed exploitation with no fix. The 7.2 branch gets no patch at all and must migrate to 7.4+.
12 days (disclosure Oct 1 → fix Oct 13)Exploited in wild: yes (zero-day)7.2 branch: no fixSources: Brandefense · Decryption Digest · OpenVPN blog
Same-day is now the bar, not the exception. Three vendors hit 0 days this week — that's what mature patch operations look like. The real differentiators were elsewhere: incomplete patches (Ahsay's August "fix" that wasn't), no-patch-at-disclosure (Fortinet's 12-day zero-day, Zammad's LPE half), and unfixable branches (FortiMail 7.2). When you evaluate a vendor, ask three questions: do they patch the same day, is the patch actually complete, and does every supported branch get one?
Patch release date minus first public disclosure date (vendor advisory, CVE publication, or researcher disclosure — whichever came first). Negative means the patch shipped before disclosure; 0 means coordinated same-day release. The exploitation window (days attackers had before any fix) is the tiebreak.
Message Ingenious AI on WhatsApp with the vendor name, CVE, and the correct published dates with links — corrections are published in the next weekly edition.
Cisco, Palo Alto, and GitLab all shipped same-day patches with their advisories (0 days each). Docker fixed GhostPat in under four hours of the report — the fastest response on the board, with a two-year exposure asterisk.
Fortinet: FortiMail CVE-2026-104286 was disclosed October 1 with no patch available, and fixed builds only shipped October 13 — 12 days of confirmed zero-day exploitation. The 7.2 branch gets no fix at all and must migrate.
Patch release date minus first public disclosure date (vendor advisory, CVE publication, or researcher disclosure — whichever came first). 0 means coordinated same-day release. The exploitation window — days attackers had before any fix — is the tiebreak.
Message Ingenious AI on WhatsApp with the vendor name, the CVE, and the correct published dates with links to the advisory. Verified corrections are published in the next weekly edition — accuracy is the point of this board, not shaming.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.
Corrections with linked advisory dates are published in the next weekly edition.