Case studies

Linux kernel use-after-free in the vsock subsystem — fix auto-merged 11 hours before public disclosure, blocking the exploit chain on patched hosts.

React Server Components deserialization flaw allowing boundary bypass — patch propagated to 14 downstream apps before the advisory went public.

OpenSSL XLLO handshake state-machine defect — zeroPatch PR accepted upstream and rolled into 6 vendor LTS branches during the embargo window.

Next.js middleware token-validation regression — surface patched across staging ahead of disclosure, no customer interrupt.

curl URL parser parser-confusion bug on percent-encoded NUL bytes — tracked fix merged into our deployment pin the same day.