China’s Hackers Are Legally Required to Hand Zero-Day Vulnerabilities to the Government Before Anyone Else. Every CVE Has a New First Customer.

There’s a rule in cybersecurity that everyone learns early: information about a vulnerability is more valuable than the vulnerability itself. Knowing that a million Microsoft Exchange servers have a hole nobody’s patched yet is worth far more than knowing how to sneak through that hole on one specific server. The information is the asset.

Every country’s intelligence agencies know this. They run bug bounty programs, host hacking competitions, fund research, and quietly buy zero-days on gray markets. The US, Russia, Israel, and a handful of others all play this game.

But only one country has made the game mandatory by law.

In September 2021, China’s Cyberspace Administration enacted the “Regulations on the Management of Network Product Security Vulnerability.” If you read the document with a security mindset, it reads less like a vulnerability disclosure policy and more like a sourcing pipeline. Any Chinese researcher, vendor, or company that discovers a software vulnerability has 48 hours to report it to the government. Selling it abroad? Banned. Disclosing it to overseas vendors before reporting domestically? Banned. Publishing exploit code? Banned.

Five years later, the data on what’s happened since is starting to look very, very interesting.

What the law actually says

Let me break the regulation down in plain English, because the legal language hides how aggressive it is:

Reporting deadline:        2 days after discovery
Who must report:           Anyone in China who finds a flaw
Where to report:           MIIT (Ministry of Industry and IT)
Permitted disclosure:      To the affected vendor (yes)
                          To the public (only after govt approval)
                          To foreign govts/researchers (no)
Banned actions:            Selling vulnerabilities
                          Publishing exploit code
                          Disclosing to overseas organizations
                          Helping foreign researchers
Penalties:                 Fines, criminal liability, license loss

Now think about what this looks like operationally. A researcher at a Chinese tech firm finds a critical Microsoft Exchange bug on a Tuesday. By Thursday, that bug has to be in the hands of MIIT. The researcher cannot sell it on the international market, cannot tip off Microsoft directly first, cannot publish a paper, cannot drop a Tweet. The Chinese government has, by law, become the first customer of every Chinese-discovered vulnerability.

The vendor still gets notified eventually. But “eventually” is doing a lot of work in that sentence.

The Microsoft data point

In November 2022, Microsoft published its annual Digital Defense Report. Buried in it was a section on Chinese state-backed hackers and their use of zero-days. Microsoft observed that the increased use of zero days over the year reflected the first full year of China’s vulnerability disclosure requirements for the Chinese security community and described it as a major step in the use of zero-day exploits as a state priority.

Microsoft listed several CVEs that Chinese state actors developed or weaponized first, before the broader hacker community caught up:

• CVE-2021–35211 — SolarWinds Serv-U
• CVE-2021–40539 — Zoho ManageEngine ADSelfService Plus
• CVE-2021–44077 — Zoho ManageEngine ServiceDesk Plus
• CVE-2021–42321 — Microsoft Exchange (notably surfaced at the Tianfu Cup hacking competition in Chengdu, then exploited in the wild within a week)
• CVE-2022–26134 — Atlassian Confluence Server

The Tianfu Cup point is worth a pause. Tianfu is essentially China’s version of Pwn2Own, the international hacking competition. After Chinese researchers were forbidden from participating in foreign competitions like Pwn2Own (a separate but related decision), Tianfu became the showcase. Researchers find vulnerabilities, demonstrate them on stage, win prize money. The bugs are then… reported to MIIT, per the law. Some of them have shown up in active state-backed campaigns shortly after.

Now, fairness check. Microsoft used the word “might” in its report. They didn’t claim a direct, evidenced pipeline from MIIT to APT groups. They observed correlation. They said the timing “likely reflects” the new law. There’s a difference between “we have proof” and “we have a strongly suggestive pattern,” and Microsoft was careful about which one they were claiming.

But the pattern is the pattern.

The Atlantic Council’s pipeline

A 2023 Atlantic Council report, titled “Sleight of hand: How China weaponizes software vulnerabilities,” went deeper. The authors mapped out how vulnerability data flows from Chinese private sector reporting into the Chinese government’s cybersecurity apparatus.

The report’s argument, simplified:

Chinese researcher discovers vuln
         │
         ▼
Reports to MIIT within 48 hours (by law)
         │
         ▼
MIIT shares with CNVD (vulnerability database)
         │
         ▼
CNVD has organizational ties to MSS
(Ministry of State Security, China's CIA)
         │
         ▼
Some bugs reach offensive teams
         │
         ▼
Bugs get used in state-backed operations

The Atlantic Council noted that organizations with ties to offensive hacking activities would be negligent if they did not utilize their access to CNVD vulnerability reports to equip their operators, and that the observable increase in zero-days used by PRC hacking teams suggests that those organizations’ access is producing real operational results.

Again, this isn’t proof of a smoking-gun pipeline. It’s an institutional analysis. But the argument is convincing in the same way that the existence of a sealed envelope in a courtroom is convincing. You can see the shape of the contents even without opening it.

The flip side: why the law might also hurt China long-term

I want to be careful not to write a one-sided piece, because there’s a real argument that this policy hurts China too. A few security analysts pointed this out almost immediately when the regulation passed.

Brain drain risk. Top researchers have always been able to go anywhere. If the rules say “you cannot collect bug bounties internationally, you cannot publish at DEF CON, you cannot participate in Pwn2Own, and your discoveries belong to the state by default,” some of those researchers will simply… leave. Or stay quiet. Or stop researching. The pipeline only fills if researchers keep working in China and keep reporting bugs.

Legitimate research chilling effect. Western academic security research benefits from the open exchange of vulnerability data. Coordinated disclosure, conferences, papers, public proof-of-concepts. Chinese researchers have largely been pulled out of that ecosystem. That helps the Chinese government in the short term and hurts global security culture in the long term, including China’s own ability to defend its own systems.

Pwn2Own pullout. Chinese teams used to dominate Pwn2Own, the major international hacking competition. After 2018, the Chinese government effectively pulled them. The bugs that used to surface publicly on a stage in Vancouver now surface privately at Tianfu in Chengdu, with whatever consequences flow downstream from that.

Quality vs quantity. The law doesn’t create new bugs. It just changes who hears about them first. If the global vulnerability discovery rate stays the same, China gets a head start on a slice of bugs found in China, but doesn’t suddenly find more bugs.

So the picture is more nuanced than “China invented a cheat code.” The country has built a privileged-access pipeline at real cost to its own research ecosystem and global security cooperation.

What this means if you’re a defender

Here’s the practical worry for anyone running infrastructure outside China.

A vulnerability disclosed first to MIIT doesn’t reach you when it reaches the vendor. It reaches you whenever the vendor decides to publish a CVE and ship a patch. Between those two moments, the vulnerability exists in a kind of asymmetric darkness: the Chinese state arguably knows, the foreign vendor maybe-eventually-knows, and you definitely don’t know.

In practical terms:

Day 0:   Chinese researcher finds bug in Product X
Day 2:   Bug disclosed to MIIT (legally required)
Day 2:   Possible operational use begins
Day ?:   Vendor (say, in the US) gets notified
Day ?+N: Vendor patches and assigns CVE
Day ?+N: You finally see it in your patch queue

The window between Day 2 and Day ?+N is the window of state-level asymmetric advantage. Microsoft suggests it takes on average 14 days for an exploit to appear in the wild after public disclosure, 60 days for a working proof of concept, and 120 days for the bug to be in automated tools. But that’s after public disclosure. The pre-disclosure window is the one this law expanded.

Some practical responses defenders can adopt:

- Patch as fast as humanly possible (faster than that)
- Assume any CVE with a Chinese researcher attribution
  has had a longer "private life" than the timestamp suggests
- Apply zero-trust principles so any one bug doesn't blow
  the whole network
- Watch for industries China prioritizes: critical infra,
  defense, telecom, AI, semiconductors
- Don't trust "low severity" rankings on bugs in software
  China cares about, even if they look minor on paper

A quote that stuck with me

There’s a line from Joseph Carson, the chief security scientist at ThycoticCentrify, when the law was first announced in 2021: “I would expect the Chinese Government to weaponize any discovered security vulnerabilities to enhance China’s cybersecurity capabilities.”

What’s interesting is that the prediction was trivially obvious in 2021. Anyone with a security background made the same call. And five years of data have, fairly clearly, confirmed it. We didn’t need spy novels to figure out what would happen. We just needed to read the law and assume governments behave like governments.

There’s a related quote that’s older, sometimes attributed to Sun Tzu but with murky sourcing, so I’ll just say it as a principle: the side that knows what’s hidden in its enemy’s walls has an advantage. The vulnerability disclosure law was, intentionally or not, a structural advantage built into Chinese state cybersecurity.

The honest summary

If you cut through the policy debate and the geopolitics, here’s the substance:

1. China has a law that gives the state first access to a slice of newly discovered vulnerabilities, before vendors fully patch and before the public knows.
2. There’s strong circumstantial evidence (Microsoft’s reporting, Atlantic Council analysis, the Tianfu Cup pattern) that some of those vulnerabilities flow into state-backed offensive operations.
3. Western governments and most large companies don’t have an equivalent legally compelled pipeline. They buy zero-days, they pay bounties, but they don’t conscript discoveries.
4. The asymmetry is real but not absolute. The law also costs China something, in research culture, brain drain, and global cooperation.
5. For anyone running infrastructure, the window between Chinese state knowledge and foreign vendor patches is the window where this asymmetry actually bites you.

The most uncomfortable thing is that this isn’t a secret operation. It’s not a leak from a whistleblower. It’s a published regulation. Every claim above is backed by public Chinese law and public Microsoft and Atlantic Council reporting. The question was always whether anyone outside the cybersecurity world would notice, and so far the answer has been mostly no.

But every CVE you’ve seen in the last few years that traces back to a Chinese researcher has, by law, had a different first customer than the vendor. That’s the new normal. We’re all just patching around it.

Have you seen this pattern in your own patch cycles, or do you think the “Chinese researcher attribution” signal is overblown? Curious what defenders are actually noticing in the wild, leave a comment.