Definition
Patch gap is a patch gap is the time between a security fix becoming visible to the public and users actually installing the update, a window in which attackers can study the fix and exploit the unpatched flaw.
A patch gap is the stretch of time when a security fix exists but you are not protected by it yet. The fix has been written, and sometimes published, but the update has not reached your machine or you have not installed it.
Fixing a bug and protecting users are two different steps. Developers write the fix, test it, build a release and publish it. Then every user has to receive it and, often, restart the program. Each step takes time, and the slowest one is usually the last: people postpone restarts, administrators wait to test updates, and some systems rarely update at all.
The gap gets wider when the fix is public before the release is. Open-source projects often commit a fix to a public repository days before a packaged update ships. Anyone reading that change can see exactly what was wrong.
A published fix is a map. It points to the vulnerable code and often to the way to trigger it. Attackers compare the old and new versions, work out the flaw and build an exploit for everyone who has not updated. This works against a flaw that is no longer secret to the vendor but is still unfixed on your computer. It differs from a zero-day vulnerability, where no fix exists at all.
Reading a fix and writing an exploit used to take skilled people a lot of time. AI models can now speed up that work, which makes every hour of the gap more valuable to an attacker. Researchers have reported that AI models can turn public security patches into working attacks on software that has not yet been updated. That is why teams that ship software now watch the hours between a public fix and the update landing.
If you build software: ship fixes in small releases, use automatic updates, keep a fix private until the release is ready, and avoid bundling several bugs into one change that could be chained together.
If you use software: turn on automatic updates, restart browsers and apps when they ask, and treat "the fix exists" as different from "I am protected."
A browser team fixes a memory bug on Monday and posts the change publicly. The packaged update reaches most users on Thursday. Between Monday and Thursday, the bug is described in public and still open on every laptop that has not updated. That is the patch gap.
The gap is part of vulnerability management and links to remote code execution, the kind of flaw that makes it dangerous, to a supply chain attack, another route into updated or unupdated software, and to fuzzing, a way defenders find bugs before attackers do. An agent sandbox can limit the damage when something slips through.
A zero-day has no fix yet. A patch gap begins after a fix exists, and lasts until users have installed it.
Turn on automatic updates and restart apps when prompted. Teams can ship smaller, faster releases.
CrowdStrike says a likely Chinese-speaking, financially motivated actor ran ARTEX, an open-source agentic pentest tool, against South Korean financial firms from late September, and cites industry reports of breaches at two banks. The model under it was swappable, and that is the warning.
PHP released fixes on October 21 for two flaws rated 9.2 that let attackers take over servers without logging in, found by Wiz with Gemini and GPT models. If your site runs PHP, updating today is the job.
Epoch AI says Z.ai's open-weight GLM 5.3 built working exploits for all six Firefox releases it tested, at about $1,000 each, by reading public security fixes. If you ship software, the gap between a public fix and an installed update is now an attack surface.