China delays notification of software holes targeted in state hacks

Recorded Future's analysis claims that China’s CNNVD routinely delays publication of high-severity, actively exploited vulnerabilities—particularly those used by China-linked APT malware—by weeks to months compared to the U.S. NVD, suggesting the vulnerabilities may be evaluated for intelligence utility by China’s Ministry of State Security before disclosure.