Probes hit a maintainer's webserver ten minutes after his fix PR went public

Ten minutes is about how long it takes to read a diff and spot the check that was missing. It was also the gap between the pull request opening and probes carrying the exact bug pattern arriving at Madhavapeddy's webserver ^[2]. Generating the exploit is not what fills that gap. In his own attempt, DeepSeek V4 Pro wrote it in under a minute from only a vague description ^[3]. Subtract that and roughly nine minutes cover everything else: seeing the PR, reading it, pointing a model at the right function, aiming the probe ^[12].

Two separate observations sit behind the story. One is the probe traffic. The other is his own reproduction with a model. The tl;dr sec item does not identify who sent the probes or what tooling they used, so the chain from model to probe is inferred ^[13].

He pointed his own Claude at the code, Fable refused over its security block, and DeepSeek V4 Pro wrote the exploit instead ^[3].

Coordinated disclosure prices secrecy as time: the bug stays quiet until the fix ships ^[4]. Madhavapeddy's argument, as the newsletter relays it, is that a rumour alone now hands an agent enough to find the flaw, so mean time to exploit has gone negative and exploitation precedes the patch ^[5].

He lists three ways out and finds a flaw in each ^[9]. GitHub's temporary private forks let you hide the patch, but they cut you off from CI ^[6]. Continuous shipping works for Chrome because Chrome is a single binary, not a library buried in a hundred products nobody controls ^[7]. Cloud providers can slam mitigations in at the protocol layer, and open source has no CDN to carry the same rules ^[8].

Whether ten minutes is your number depends on the bug. Path traversal in an HTTP library is legible from the diff, reachable over the network, and needs no environment-specific setup. All three had to hold for the exploit to be a one-minute job ^[3]. I would not expect the same window for a use-after-free behind an allocator, and this is one maintainer reporting on one library. The interval under pressure comes before any remediation deadline: it is the order in which the fix and the knowledge become public.

"Within 10 minutes is insane," tl;dr sec wrote ^[10], predicting that the problem "is and will continue to be an important area of security, and may hit hard over the next few months" ^[11].