Trusted by teams that can't afford to wait for upstream patches.
Customer remediation logs as we publish them — how teams running ZeroPatch got a CVE closed before the upstream vendor shipped one. We start with LegacyHive and CVE-2025-21756, and CVE-2025-29927. More remediation logs will follow as new studies are published.
What's inside
- Three live case studies you can read end to end — LegacyHive, CVE-2025-21756, and CVE-2025-29927.
- Three published case studies are ready to read end to end.
- A clear invite: be the next referenceable team on this page.
Case studies
Read the remediation logs as we publish them.
Each case study is a single timeline from public disclosure to shipped fix — proof-first, no marketing-led reordering.
Six days from a public PoC to a free ZeroPatch micropatch — no paid seat, no upgrade cycle.
Free micropatch shipped 6 days after public PoC for CVE-2025-21756
Linux kernel vsock use-after-free — fix merged 11 hours before disclosure, exploit chain blocked on every patched host before the PoC dropped.
Fix auto-merged 11 hours before public disclosure — no customer interrupt.
Next.js middleware authorization bypass — the affected release lines, fixed versions, and audit-backed merge are all visible in one remediation log.
Critical remediation recorded as merged on 2026-09-02.
3 published case studies.
Evaluate micropatches with production evidence.
These published remediation logs give enterprise teams a proof point as they evaluate micropatches. If you are assessing your production dependency graph, talk to us about an enterprise remediation path for your team.