[Verse 1]
Released on the fifth, only approved eyes allowed to peek,
Nine hundred forty-eight working Linux root exploits in a week,
Pulled from two thousand three hundred eight candidates they ran,
Compare that to GPT-5.6 Sol — one sixty-six, a smaller span.
Eighty-one Firefox flaws, Mozilla stamped them high,
That severity rating's real, no reason here to lie.
But the quiet part the headline left asleep inside the frame —
these are local privilege bugs, attackers need access first, same.
[Chorus]
Dime la verdad, no solo el titular,
Nine forty-eight found, pero pocos van a sanar,
Solo trescientos cuatro disclosed, sixty-one fixed in days,
The rest still breathing quiet in the maintainers' haze.
[Verse 2]
Of those three-oh-four sent to the people who repair,
Sixty-one got patched in ten days, forty-three staged with care,
How many were brand new before? That count's still in dispute —
don't let a bold headline stand in for the actual proof.
Rewind the calendar — Claude Mythos, earlier this year,
found two seventy-one Firefox zero-days, crystal clear,
so this ain't one mind alone combing through the code,
context is the flashlight on a crowded, crooked road.
[Chorus]
Dime la verdad, no solo el titular,
Nine forty-eight found, pero pocos van a sanar,
Solo trescientos cuatro disclosed, sixty-one fixed in days,
The rest still breathing quiet in the maintainers' haze.
[Verse 3]
OpenAI says access widens to all Daybreak Red soon,
no date attached, just a promise hummed like a quiet tune,
Fouad Matin watches the dashboard, Patch the Planet, close,
less than twenty-five percent mended — that's the number that shows.
Rob T. Lee over at Dragos, voice calm but words that sting,
"the skill floor keeps on dropping" — small hands holding sharp things.
[Bridge]
No es pánico, es un dato — read the whole report,
local root, not remote entry, that's the full import,
watch the fixed percentage climb, or watch it barely crawl,
la verdad en números — that's the truest call.
[Verse 4]
Every lab's racing fast, publishing scores like a trophy case,
but the patch rate tells the story they don't put on the front page,
Anthropic, OpenAI, Google — all counting different ways,
normalize the metric first before you sing the praise.
Ask what's disclosed responsibly, ask who verified the claim,
ask if "zero-day" today means the same as it did back when,
the number needs a neighbor — context, scope, and date,
without the guardrails round it, raw numbers obfuscate.
So before you share the headline, before you spread the fear,
trace it to the source document, make the method clear,
because a scoreboard without context is a story incomplete,
and the truth deserves more rigor than a viral tweet.
[Chorus]
Dime la verdad, no solo el titular,
Nine forty-eight found, pero pocos van a sanar,
Solo trescientos cuatro disclosed, sixty-one fixed in days,
The rest still breathing quiet in the maintainers' haze.