Time-to-exploit is now negative: attacks begin before the patch ships