There's always one coming. Have you seen XPERIcheck? They get a few done each day and cycle through the whole active lineup every 30 to 120 days, depending how much they care about your market. Security patches are at least one month behind. If your release cycle is longer than 1 month (most phones) then your patch is 2 or 3 months old when it arrives.