When "Lost" Exploits Don't Stay Lost

The Pressure System

Following up on my last post about vulnerabilities that quietly disappear into triage limbo—we're now seeing what happens when pressure builds and the system has fewer release valves.

A recent report highlights leaked Windows Defender zero-days affecting potentially over 1 billion users after a breakdown between a researcher and the vendor. At the same time, there's been a noticeable shift in the background:

• Zerodium—once one of the largest buyers of zero-days—has significantly reduced or paused purchases of certain high-end exploits on the U.S. front
• Fewer legal gray-market outlets for researchers to offload findings
• Increasing legal and policy pressure around exploit sales and disclosure

So now we have a tightening funnel:

That middle ground—the "gray zone"—is getting squeezed. And when that happens, outcomes start to shift:

• More tension in disclosure timelines
• Higher likelihood of frustration-driven exposure
• Greater systemic risk if vulnerabilities surface without coordination

The Stable System Myth

We like to think of responsible disclosure as stable infrastructure:

Researcher → Vendor → Patch → Safety 🔐

But what we're actually dealing with is a pressure system.

And right now:

• Incentives are changing
• Outlets are narrowing
• Timelines are still inconsistent

That combination matters. Because if:

• Researchers feel stuck with no resolution path
• Vendors don't provide transparent, timely engagement
• And external markets for exploits contract

Then "lost exploits" don't just sit quietly anymore. They build pressure until something gives.

Case Study: When Frustration Goes Public

The Windows Defender Zero-Day Leak (April 2026)

The clearest recent example is the Windows Defender zero-day cluster publicly released in April 2026 by a researcher using the alias Chaotic Eclipse.

The Shrinking Exploit Market

Zerodium's Quiet Retreat

Zerodium, historically one of the largest exploit brokers, began significantly restricting purchases starting in 2023:

Market Contraction by the Numbers

The Price Divergence

While the market contracted, prices for premium exploits exploded—but only in the gray market. Legitimate channels couldn't keep up.

Browser Exploit Pricing (2020 vs 2026)

The Frustration → Alternative Path Pipeline

While direct "vendor dismissed me, so I sold it to Zerodium" cases are rare in public (exploit sales are private), the broader pipeline is well-documented:

Why Direct Sales Are Invisible

The scarcity of public "dismissal → sale" cases is explainable:

• Exploit sales are confidential — Brokers advertise buying "original and previously unreported zero-day research," but transactions are private
• Public admission creates legal risk — Openly saying you sold an unpatched exploit invites scrutiny from vendors, law enforcement, and future employers
• Public disclosure is better leverage — If the goal is to pressure the vendor or maintain reputation, a blog post is more visible than a private sale

Project Zero: Pressure Without Resolution

Google Project Zero's 90-day disclosure deadline has been one of the most important forcing functions in vulnerability disclosure. It improved vendor response times dramatically—but it also created new failure modes.

What Improved

• Median patch times decreased from ~120-200 days (pre-2014) to ~30-60 days (2020s) for top vendors
• Industry-wide accountability and transparency
• Forced prioritization of high-severity bugs

What Didn't Improve

• Vendor triage quality
• Researcher trust
• Handling of disputed findings

New Risks Introduced

• Public disclosure before safe patch — If vendor fails to fix in 90 days, vulnerability becomes public while users are still unprotected
• Rushed patches — Some vulnerabilities require architectural changes; 90 days may be too short for safe remediation
• Increased adversarial dynamics — Vendors may stall until deadline, then rush patch at last minute

Where the Exploits Actually Go

When vendors fail and legitimate markets shrink, who is actually acquiring exploits?

Nation-states remain the dominant high-end buyers—but the acquisition pipeline has evolved from broker-centric to more fragmented, opaque, and sometimes direct channels.

The Pipeline Evolution

Evidence of Ongoing Acquisition

The Legal Squeeze

The legal landscape shifted in two opposite directions between 2020-2026:

CFAA Got Narrower (Good for Researchers)

After Van Buren v. United States (2021), the Supreme Court rejected expansive CFAA interpretations. DOJ later updated charging policy, limiting aggressive theories around terms-of-service violations.

Export Controls Got Broader (Bad for Exploit Sales)

Cases like Project Raven (2021) and Peter Williams (2025-2026) show that selling exploit capabilities—especially when tied to stolen IP, foreign governments, or restricted brokers—can lead to:

• Deferred prosecution agreements
• Multi-million-dollar penalties
• Asset forfeiture (cryptocurrency, house, luxury goods)
• Prison (87 months in Williams case)

The Fragmented Ecosystem

As structured markets shrink and vendor trust declines, disclosure becomes more fragmented, less transparent, and more strategic.

Emerging Alternative Paths

The Transparency Gap

Most major vendors do not publish meaningful public transparency about their vulnerability triage queues. We can see outputs (payouts, valid bugs, advisories) but not the queue dynamics that determine whether researchers feel heard, delayed, dismissed, or pushed elsewhere.

What Vendors Publish

• Total payouts
• Number of rewarded researchers
• Sometimes counts of valid findings
• Public CVE/advisory feeds after resolution

What Vendors Don't Publish

• Average or median time to first human response
• Average or median time to triage decision
• Backlog size
• Share of reports marked: valid, invalid, duplicate, informational/won't fix
• Percentage of valid reports that led to patch vs. accepted risk

HackerOne and Bugcrowd expose the richest queue metrics, but primarily to customers inside their platforms rather than to the public. Google, Microsoft, and Apple publish stronger data on payouts and valid bugs than on queue health or rejection-path breakdowns.

The public can see that vulnerabilities are found and sometimes fixed, but cannot clearly see how many reports are delayed, deprioritized, marked informational, or left to age in the queue.

The Real Question

This isn't about defending leaks or unsafe disclosure. It's about recognizing the ecosystem dynamics that make them more likely.

We're dealing with a pressure system where:

• Researchers find valid vulnerabilities
• Vendors provide inconsistent, opaque triage
• Exploit brokers have contracted 40-70%
• Legal risks have increased for alternative paths
• Nation-state demand remains constant but less visible
• Transparency about queue health is minimal

When researchers end up with:

• Valid findings
• No response or dismissive response
• No legal outlet
• And no good options

...the exploits don't stay lost. They build pressure until something gives.

Because right now, the system is optimized for outputs (patches, advisories, bounty totals) but not for trust (queue transparency, researcher experience, coordination quality).

And when trust breaks, exploits don't disappear. They migrate to the highest bidder with the least visibility.

The disappearance of brokers like Zerodium from public visibility does not mean exploits stopped being sold—it means they stopped being sold where we can see them.