Silent Patches Blind Defenders While Still Exposing Vulnerabilities to Attackers

The Flaw in Silent Patching

Some vendors choose to fix vulnerabilities without public advisories, CVEs, or detailed explanations, often providing only vague changelog entries. The rationale behind this approach is to avoid publicizing bugs and providing attackers with a roadmap to exploit them.

Attackers Still Discover Vulnerabilities

Patches are not secret once released. Attackers with skills in debugging and disassembling can compare old and new binaries to identify changes and understand the underlying vulnerability. The barrier to entry for sophisticated exploit development has also lowered due to advancements in tools like LLMs.

Impact on Defenders

Silent patching primarily disadvantages defenders. This includes penetration testers who demonstrate risk, vulnerability management engineers who build detection signatures, and IT administrators who must prioritize and apply patches. These groups rely on clear information about severity and exploitability to make informed decisions, and they typically do not have the resources or time to reverse-engineer binaries to uncover hidden vulnerabilities.

Misplaced Secrecy

Instead of limiting knowledge of a vulnerability to a small pool of people, silent patching limits disclosed truth to a small pool of people specifically motivated to reverse-engineer the product, which often skews towards attackers. This leaves those trying to defend users with incomplete data. Additionally, future product engineers might reintroduce the same bug if its original fix was kept secret.

Limited Justification for Delayed Disclosure

A brief delay in full disclosure might be defensible in very specific scenarios, such as for hosted, SaaS-delivered products where users have no patching decisions to make. In such cases, a short embargo to patch the vendor's own fleet does not hide meaningful information from users.