Project Zero will disclose vulnerabilities 90 days after reporting

Ubuntu will need a LOT more time than that.

Starting today, our policy is “Full 90”, i.e. vulnerabilities will be disclosed 90 days after they are reported to the vendor.

On February 2, 2027, we will move to a “Full 60” policy where vulnerabilities are disclosed after 60 days.

On January 3, 2028, we will move to a “Full 30” policy where vulnerabilities are disclosed after 30 days.

Unrelated, but didn't realise .google was a TLD.

[flagged]

I’m not familiar with this specific effort but it seems like the companies digging around for the bugs should also offer similar access to their products that discovered the vulnerabilities to the vendors or OSS projects to patch them. Otherwise vendors might use this as a leveraged approach to get people to adopt LLMs, specifically theirs, so their products remain reasonably attractive. Google, OpenAI, Anthropic etc could just turn on existing software as a strategy to get more adoption of their tools.

“Don’t like our constant stream of patches? For $10k/mo + tokens you can get access to the model to patch the vulnerabilities we disclose!”