Security teams keep finding critical flaws after scheduled testing ends