Google Project Zero to cut vulnerability disclosure window to 30 days by 2028

The significance here is less about any single bug than about the disclosure norm itself: a 90-day standard that shaped industry expectations is being compressed on a published schedule, and the burden of faster patching lands on security teams and vendors, not on researchers. The explicit AI rationale suggests discovery is outpacing remediation capacity across the ecosystem. Whether vendors can match the shrinking window — and whether the three exceptions absorb the pressure — is the open question to watch as the 2027 and 2028 deadlines approach.