{"resourceId":"nvidia-product-security-github-readme-bulletins-github-only-20260901","versions":[{"version":"external-f0dc9e170748189aed0383944336a91c975e6ec8f50eff00e442686709dae1f8","resource":{"id":"nvidia-product-security-github-readme-bulletins-github-only-20260901","title":"NVIDIA product-security repository: from Oct 1, 2026 PSIRT will 'only' publish security bulletins on GitHub in Markdown, CSAF and CVE formats","organization":"NVIDIA PSIRT","sector":"Technology vendor (product security)","geography":"Global","publishedAt":"2026-09-01T16:44:01Z (README last committed)","publicationDate":"2026-09-01","eventDate":"2026-10-01","sourceName":"GitHub — NVIDIA/product-security","sourceLabel":"Vendor repository README","sourceUrl":"https://github.com/NVIDIA/product-security","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","governance-procurement","operating-model"],"finding":"The README of NVIDIA's product-security GitHub repository (last changed Sep 1, 2026) says that starting October 1, 2026, NVIDIA PSIRT will only publish security bulletins on GitHub in Markdown, CSAF and CVE formats. It describes per-bulletin Markdown, machine-readable CSAF and CVE Record files, organized by year, and says older bulletins will be added gradually. It asks readers to subscribe to the repository for notifications, with email available via the Product Security page. Unlike the website, the README does not say the website will keep publishing in parallel. The 2026 index listed 62 bulletins when read tonight, the newest two dated Oct 6.","sledRelevance":"State and campus security operations teams that patch NVIDIA GPU drivers, vGPU, TensorRT or AI software need to know which feed is authoritative. A move to GitHub-only publication changes where vulnerability management tools and analysts must watch, from October 2026.","evidence":"Fetched the raw README (1,336 bytes) and the 2026 index from GitHub; checked the README commit history via the GitHub API (last commit Sep 1, 2026).","architectureImplications":"Vulnerability management pipelines that scrape the NVIDIA website should add the GitHub repository (or its CSAF files) as a source.","governanceImplications":"Patch policies that name a vendor advisory source should be updated to name the GitHub repository and define what happens if the two sources differ.","securityPrivacyImplications":"A missed feed means missed driver and AI-software patches; per-file SHA-256 checksums allow integrity checks of downloaded advisories.","caveats":"The README states intent; it does not show whether the website will in fact stop updating. Contradicted in part by NVIDIA's own Product Security page.","streamIds":["nvidia"],"roles":{"sales":"For state and campus security leaders, NVIDIA's bulletins now officially live on GitHub, and the repository README says GitHub only. That is a practical prompt: many public-sector vulnerability programs watch vendor web pages or email. We can offer a quick check of whether their NVIDIA patch monitoring covers the GitHub feed. We should not overstate the risk; NVIDIA's website still lists bulletins tonight and email subscriptions remain, so this is a feed-hygiene issue, not a disclosed gap.","engineering":"Engineering fit: add NVIDIA/product-security as a monitored source, preferably by ingesting the CSAF JSON and CVE files with checksum verification. Prerequisites are a vulnerability management tool or script that can pull from GitHub. Constraints: standard CSAF discovery may not work (see the vulnerability-lookup audit), and older bulletins are still being backfilled. Proof of value: confirm the Oct 6 TensorRT (5891) and Model-Optimizer (5903) bulletins appear in your tooling within a day.","delivery":"Delivery work is updating the vulnerability intake process: name the GitHub repository as the NVIDIA source of record, subscribe the security team, and map bulletin products to the asset inventory. The security operations lead owns the change. Checkpoints are the feed change, the first ingested bulletin and the monthly patch review. Proposed acceptance criterion: every NVIDIA bulletin published after Oct 1 is ticketed within one business day. Risk: website-only monitoring silently misses bulletins if NVIDIA stops updating the site."},"roleDetails":{"sales":{"customerProblem":"Public-sector security teams may be watching the wrong NVIDIA advisory channel after the Oct 1 change.","stakeholders":["Agency or campus CISO","Security operations lead","Research computing administrators","IT asset management"],"discoveryQuestions":["Where does your team get NVIDIA security bulletins today?","Does your vulnerability tool ingest CSAF from GitHub?","Which NVIDIA products are in your asset inventory?"],"valueHypothesis":"A short feed review can close a possible gap in NVIDIA patch monitoring at low effort (interpretation).","potentialEngagement":"A one-hour advisory-feed check covering NVIDIA and other vendors that moved to machine-readable feeds.","unsupportedClaims":["That the website has stopped publishing","That any agency missed a patch because of this change","That GitHub-only publication is less secure"]},"engineering":{"fit":"Applies to any SLED organization running NVIDIA drivers or AI software.","architectureIntegration":"Pull CSAF and CVE JSON from the repository, verify SHA-256 files, and map products to inventory.","prerequisites":["Vulnerability management tool or script","GitHub access from the security network","Asset inventory with NVIDIA components"],"constraints":["CSAF lacks consumable provider metadata for generic tools","Older bulletins still being added"],"security":"Verify checksums on downloaded advisories; treat the feed as security-critical input.","proofOfValue":["Confirm bulletins 5891 and 5903 appear in tooling","Test alerting on a repository change"]},"delivery":{"work":"Update NVIDIA vulnerability intake to the GitHub repository and test it.","dependencies":["Security tooling","Asset inventory","Patch management process"],"ownership":"Security operations lead owns the intake change and monthly review.","skillsAdoption":"Analysts learn to read CSAF and the repository index.","governanceCheckpoints":["Feed change approved","First bulletin ingested","Monthly patch review"],"acceptanceCriteria":["Every post-Oct 1 NVIDIA bulletin ticketed within one business day (proposed)","Feed source documented in patch policy (proposed)"],"risks":["Website-only monitoring","Unclear authoritative source","Backfill gaps for older bulletins"]}},"retrievedAt":"2026-10-07T03:02:15Z","enrichedAt":"2026-10-07T03:09:23Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Analysts unfamiliar with GitHub or CSAF may need brief training; email subscription remains for smaller teams.","procurementImplications":"Vulnerability management tool contracts should confirm support for vendor CSAF feeds hosted on GitHub.","operatingModelImplications":"Advisory intake shifts from reading web pages to ingesting machine-readable files.","sourceVerification":{"openedUrl":"https://github.com/NVIDIA/product-security","referenceExcerpt":"NVIDIA PSIRT will only publish security bulletins on GitHub in Markdown, CSAF, and CVE formats to meet industry demand","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}