Hackers used to take months. Now it's days.
When a software company finds a security hole, it puts out a fix, and a race starts. In 2018 and 2019, attackers took 63 days on average from the fix coming out to start using the hole. By 2023 it was five days. In 2024, on average, the attacks started a day before the fix was released. That's from Google's Mandiant team, who measure it.
Now AI is helping attackers go faster still. The Australian Signals Directorate says AI almost certainly lets them attack on a larger scale and at a faster rate. The UK's National Cyber Security Centre says it will almost certainly shrink the gap between a hole going public and the first attack even further.
On WordPress, it can be a matter of hours. In 2025, one in five of the most-attacked WordPress holes saw a first attack within six hours of going public, by Patchstack's count.