Matt's Guide to Vendor Response
Summary: Cisco Talos's Matt Watchinski published a guide to vendor response that walks software vendors through three cases: confidential researcher notification, public disclosure without active attacks, and discovery of an unknown vulnerability being exploited in the wild. The guide cites an estimate that the Adobe JBIG2 bug was worth between 75 and 100 thousand dollars, and notes that Sourcefire found the JBIG vulnerability in under 10 minutes after setting a fuzzer on the JBIG tag.
What's compelling: The guide's central claim is that vulnerability data has real market value - government agencies and other organizations pay good money for it - so a researcher who hands it to a vendor has given up a substantial sum, and how the vendor responds defines how it is perceived.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026