50 SHADES OF VULNERABILITIES: UNCOVERING FLAWS IN OPEN-SOURCE VULNERABILITY DISCLOSURES

Summary from the TLDR InfoSec newsletter

Aqua Nautilus researchers found flaws in the vulnerability disclosure process for tens of thousands of open-source projects. These flaws allowed vulnerabilities to be harvested before they were patched and announced, potentially enabling attackers to exploit security holes before users were alerted. The research also introduces two additional states in the vulnerability disclosure process: 'Half-Day' and '0.75-Day' Vulnerability.