Advisory

When someone finds a flaw in software that could let outsiders steal data or take over a device, it rarely stays secret. The vendor or a government agency then publishes a short, factual notice about it. That notice is exactly what’s called an advisory, sometimes referred to as a security notice. It states which product is affected, from which version onward, how severe the flaw is, and what should be done. Usually the recommendation is an update. An advisory, then, is not an academic paper but an action instruction in telegram style.

Why warning notices must be public

Security vulnerabilities are not only found by the good guys. As soon as a flaw becomes known, a race begins. On one side are attackers who want to exploit the vulnerability. On the other are companies and individuals who need to fix their systems. An advisory ensures that all defenders learn about it at the same time.

Without such notices, no one would know whether their own system was affected. Large companies operate thousands of servers with hundreds of software packages. They cannot possibly check every line of code themselves. Instead, their IT teams read advisories daily and cross-reference them against their own software inventory. This is routine work, but it often determines whether an attack succeeds.

A well-known case was the Log4Shell vulnerability in late 2021. It affected a tiny helper program embedded in countless Java applications. Only the advisories made many companies realize they were even using this software. Those who reacted quickly got away unscathed. Those who missed the notice were sometimes attacked weeks later.

Structure: CVE number, CVSS score, and remediation

Advisories follow a fixed format so they can be read quickly. Almost always, a CVE number appears at the top, for example CVE-2024-3094. CVE is a global catalog of security vulnerabilities. The number works like a case file reference: anyone can use it to unambiguously refer to the same vulnerability, no matter which company is writing about it.

Next comes an assessment of severity, usually as a CVSS score from 0 to 10. This score takes into account, among other things, whether an attacker can reach the vulnerability over the internet and whether a password is required. Scores of 9.0 or higher are considered critical and immediately trigger alarms at many companies. A score of 3.5, by contrast, ends up on the list for the next maintenance window.

Finally comes the remediation. Ideally, a patch already exists — that is, a fix update. Sometimes only a workaround exists: a stopgap solution, such as disabling a feature, until the proper fix is ready. It is also common for the vendor and the discoverer to agree on a deadline. The vendor gets a few weeks to prepare the patch, after which the advisory is published. This process is called coordinated disclosure.

Advisories in the news, operating systems, and AI models

You encounter advisories more often than you might think. When your phone reports a security update, there is almost always a bundle of advisories behind it. Apple, Google, and Microsoft publish monthly lists of all the vulnerabilities they’ve closed. In Germany, the Federal Office for Information Security, known as the BSI, sends its own warning notices to government agencies and companies.

Advisories also show up in business news. A critical vulnerability in widely used enterprise software can move the vendor’s stock price. For publicly traded US companies, there is the added factor that severe security incidents must be reported. An advisory is then often the first public indication of a problem that will later be reported on in detail.

The same principle now exists in the AI field as well. Machine learning software libraries also have vulnerabilities, and downloaded model files can contain malicious code. A common misconception, incidentally, is confusing an advisory with a reported attack. It describes a vulnerability, not necessarily an incident. Many flaws are fixed before anyone has ever exploited them.