Defenders of the Faith
Summary: Cisco Talos recounts that researcher Tavis Ormandy asked Microsoft on June 5 for a 60-day patch window, failed to reach agreement with the company by June 9, and released the vulnerability publicly that day; Microsoft issued an automated FixIt solution on June 11. The post argues that full disclosure devalues high-value bugs, citing the author's own loss of several bugs worth over $65,000 on the market that dropped to roughly $0 once public.
Bottom line: The piece frames disclosure as a market question: bugs are the supply chain of attacks, and public release strips APT-grade exploits of their value to attackers targeting large corporations, government, and military networks. It also argues that a bug found by one researcher is likely known to others, so a 60-day patch window leaves attackers a known, unpatched opening.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026