Zero-day WMF flaw underscores patch problems