Project Zero: Linux developers patch security holes faster than anyone else, on average in 25 days, compared to Google in 44 days, Mozilla 46, and Apple 69
Linux programmers do a better job of patching security holes than programmers at Apple, Google, and Microsoft.
Context & Ripple Effects
Project Zero’s disclosure record had already made deadline compliance visible: it said 95.8% of reported flaws were fixed before its 90-day deadline, then moved to disclose vulnerabilities at 90 days regardless of patch status. The new comparison turns that binary deadline test into a measure of remediation speed.
Linux’s 25-day average places it ahead of Google, Mozilla and Apple in the reported data, making patch-cycle performance—not only whether a vendor meets disclosure deadlines—a public point of comparison.
First-order effects
- Linux developers gain a public security-performance benchmark, while Google, Mozilla and Apple are measured against a substantially shorter reported remediation cycle.
- Project Zero’s findings give security teams and users a clearer basis for distinguishing prompt fixes from fixes that merely arrive before disclosure deadlines.
Second-order effects
- Google, Mozilla and Apple face greater pressure to shorten their vulnerability triage and release processes, because Project Zero’s 90-day disclosure policy leaves slow fixes exposed to public scrutiny.
- The comparison raises the value of closed-loop processes that connect vulnerability reports, engineering ownership and shipped fixes, rather than treating disclosure compliance as the sole target.
Third-order effects
- If public reporting continues to emphasize average remediation time, vulnerability handling is likely to be judged as an operational performance metric, not simply a pass-fail 90-day disclosure obligation.
- Project Zero’s model shifts competitive security signaling toward repeatable patch velocity, with maintainers’ release processes becoming part of their public security posture.
The trend: Coordinated vulnerability disclosure is evolving from deadline enforcement toward public benchmarking of how quickly software maintainers remediate reported flaws.