Microsoft vulnerabilities: full disclosure and no disclosure
Following on from full disclosure, Microsoft now has a new disclosure variant to contend with - no disclosure. French security services provider VUPEN claims to have discovered two critical security vulnerabilities …
Context & Ripple Effects
In mid-2010 the disclosure debate had settled into a rough equilibrium: researchers reported flaws to vendors like Microsoft, which folded fixes into its monthly patch cycle, and full public release was the fallback when coordination failed. VUPEN, a French security services provider, is now testing a third position — claiming, per the report, two critical vulnerabilities in Microsoft software while withholding the details entirely.
The move matters because it converts a bug report into a private asset: if VUPEN keeps the findings in-house rather than handing them to Redmond, Microsoft's patch pipeline never engages and the flaw stays live for every Windows user until someone else independently finds it.
First-order effects
- Microsoft's security response team has nothing to patch against: with VUPEN declining to share details, the claimed critical flaws go unfixed and unmitigated for the installed base.
- Windows customers lose the early-warning function disclosure normally provides — no bulletin, no workaround guidance, just an unverified claim that two critical holes exist.
Second-order effects
- Rival vulnerability researchers face a pricing signal: if VUPEN monetizes withheld Microsoft bugs through its security-services business rather than earning credit or bounty via disclosure, the commercial case for keeping zero-days private strengthens across the research community.
- Microsoft's trust-based relationship with the researcher ecosystem comes under strain — if withholding becomes viable, the company needs stronger incentives (bounties, credit programs) to keep bugs flowing into its patch cycle.
Third-order effects
- If the pattern holds, vulnerability discovery consolidates into a market where privately held exploit knowledge is sold to the highest bidder — vendors, brokers, or governments — rather than disclosed, eroding coordinated disclosure as the industry default.
- Regulators and enterprises would eventually have to respond to a world where critical software flaws trade as assets: expectations around vendor liability, patch guarantees, and disclosure norms all get renegotiated.
The trend: Security research is shifting from community disclosure toward commercially and strategically held zero-day vulnerabilities, with vendors' patch cycles increasingly bypassed by firms that treat bugs as proprietary intelligence.