A flaw remaining after the February patch of a zero day is already being exploited, and slow patch cycles in both government and enterprises are giving attackers the upper hand.