Patch Tuesday, Exploit Wednesday
expressionsecurityops culture
The rhythm of Windows security: fixes ship on the second Tuesday, and reverse-engineered attacks follow within days.
Microsoft's predictable cadence gave defenders a schedule - and gave attackers a diff to reverse into working exploits before slow organizations patch. The window between patch release and patch deployment is the whole game.
Patch Tuesday, exploit Wednesday describes the consequence of predictable release schedules. Microsoft ships fixes on the second Tuesday of the month, and attackers reverse-engineer those patches to find the vulnerability they fix, then attack the population that has not applied them yet.
The mechanism is worth understanding because it is counterintuitive. A patch is a description of a vulnerability: diffing the fixed binary against the previous one reveals what changed and therefore what was wrong, and that analysis is routine and fast. Publishing the fix starts a race in which the defender must deploy across an estate and the attacker only needs one unpatched target.
The scheduling trade is genuine on both sides. Predictable dates let organizations plan testing and change windows, which measurably increases how many patches actually get applied; they also give attackers a known starting gun. Out-of-band releases for severe issues are the escape valve. The practical response is to shorten the window rather than to wish the schedule away: prioritize by exploitability rather than by severity score alone, and treat the days after a release as the period of elevated risk that they demonstrably are.
Also known as: Patch Tuesday