• fruitycoder@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    1
    ·
    5 days ago

    If a public tool can find a CVE in minutes to hours, it doesn’t matter if some of the people using signed an NDA.

    All it takes is someone how isn’t going to report it to also find and exploit it

    So the exploitation window doesn’t start when it is reported it started at when the tool could have found it