research

Under coordinated vulnerability disclosure, a vulnerability is typically silently fixed on the public repository weeks before its CVE is published — and attackers can infer the vulnerability from those silent commits long before defenders hear about it. In the CVE-2018-11776 Apache Struts remote-code-execution case, a silent fix sat in the public repo for about two months before public disclosure; this is the same class of exposure window that contributed to the 2017 Equifax breach (~147.9M records). Starting from our ASE'21 VulFixMiner paper, our research line has pioneered proactive vulnerability sensing — modeling silent fix commits as the first public, inevitable signal of a hidden vulnerability, covering 65% of silent fixes 1–2 weeks ahead of CVE disclosure.