Sadly we don't have any defense against 0 days if an emergency patch is indistinguishable from an attack itself.

Better defense would be to delete or quarantine the compromised versions, fail to build and escalate to a human for zero-day defense.

> Sadly we don't have any defense against 0 days if an emergency patch is indistinguishable from an attack itself.

Reading the code content of emergency patches should be part of the job. Of course, with better code trust tools (there seem to have been some attempts at that lately, not sure where they’re at), we can delegate that and still do much better than the current state of things.