vulnerability patching cadence