The 90 day disclosure policy is dead

Himanshu Anand: “Your monthly maintenance window is not a safety margin. It is an attack window.”

See also: the time it takes to fix, qualify, build, distribute, and receive an OS update.