oss-sec debate on advance vulnerability notices to cloud providers

On 5 October 2026, a post on the oss-sec mailing list discussed responsible disclosure of vulnerabilities. According to the text, cloud computing providers use many of these services but do not consistently receive advance notifications, or receive none at all. The proposal is to centralize the process by jointly agreeing on which parties qualify, which would make disclosure easier for researchers. The post also describes the Linux kernel disclosure process as quite suboptimal, with urgency concerns. The item is an automatic translation of a list post and includes no technical details about specific vulnerabilities or deadlines. To consult the original, open the oss-sec archive for the fourth quarter of 2026 and find the thread by its title. To verify, compare with the original English wording, since machine translation may alter technical terms.