From the NVIDIA edition of October 6, 2026
NVIDIA product-security repository: from Oct 1, 2026 PSIRT will 'only' publish security bulletins on GitHub in Markdown, CSAF and CVE formats
NVIDIA PSIRT · Technology vendor (product security) · Global
- Publisher
- GitHub — NVIDIA/product-security
- Original publication
- 2026-09-01T16:44:01Z (README last committed)
- Source retrieved
- 2026-10-07
- Event date
- 2026-10-01
What happened
The README of NVIDIA's product-security GitHub repository (last changed Sep 1, 2026) says that starting October 1, 2026, NVIDIA PSIRT will only publish security bulletins on GitHub in Markdown, CSAF and CVE formats. It describes per-bulletin Markdown, machine-readable CSAF and CVE Record files, organized by year, and says older bulletins will be added gradually. It asks readers to subscribe to the repository for notifications, with email available via the Product Security page. Unlike the website, the README does not say the website will keep publishing in parallel. The 2026 index listed 62 bulletins when read tonight, the newest two dated Oct 6.
Why it matters
State and campus security operations teams that patch NVIDIA GPU drivers, vGPU, TensorRT or AI software need to know which feed is authoritative. A move to GitHub-only publication changes where vulnerability management tools and analysts must watch, from October 2026.
Evidence and measured results
Fetched the raw README (1,336 bytes) and the 2026 index from GitHub; checked the README commit history via the GitHub API (last commit Sep 1, 2026).
Limitations and uncertainty
The README states intent; it does not show whether the website will in fact stop updating. Contradicted in part by NVIDIA's own Product Security page.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-07; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public-sector security teams may be watching the wrong NVIDIA advisory channel after the Oct 1 change.
- Stakeholders
- Agency or campus CISO
- Security operations lead
- Research computing administrators
- IT asset management
- Discovery questions
- Where does your team get NVIDIA security bulletins today?
- Does your vulnerability tool ingest CSAF from GitHub?
- Which NVIDIA products are in your asset inventory?
- Value hypothesis
- A short feed review can close a possible gap in NVIDIA patch monitoring at low effort (interpretation).
- Potential engagement
- A one-hour advisory-feed check covering NVIDIA and other vendors that moved to machine-readable feeds.
- Unsupported claims
- That the website has stopped publishing
- That any agency missed a patch because of this change
- That GitHub-only publication is less secure
Pre-sales engineering
Role takeaway
- Fit
- Applies to any SLED organization running NVIDIA drivers or AI software.
- Architecture and integration
- Pull CSAF and CVE JSON from the repository, verify SHA-256 files, and map products to inventory.
- Prerequisites
- Vulnerability management tool or script
- GitHub access from the security network
- Asset inventory with NVIDIA components
- Constraints
- CSAF lacks consumable provider metadata for generic tools
- Older bulletins still being added
- Security
- Verify checksums on downloaded advisories; treat the feed as security-critical input.
- Proof of value
- Confirm bulletins 5891 and 5903 appear in tooling
- Test alerting on a repository change
Delivery
Role takeaway
- Work
- Update NVIDIA vulnerability intake to the GitHub repository and test it.
- Dependencies
- Security tooling
- Asset inventory
- Patch management process
- Ownership
- Security operations lead owns the intake change and monthly review.
- Skills and adoption
- Analysts learn to read CSAF and the repository index.
- Governance checkpoints
- Feed change approved
- First bulletin ingested
- Monthly patch review
- Acceptance criteria
- Every post-Oct 1 NVIDIA bulletin ticketed within one business day (proposed)
- Feed source documented in patch policy (proposed)
- Risks
- Website-only monitoring
- Unclear authoritative source
- Backfill gaps for older bulletins
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Vulnerability management pipelines that scrape the NVIDIA website should add the GitHub repository (or its CSAF files) as a source.
Governance
Who approves, reviews and stays accountable for outcomes?
Patch policies that name a vendor advisory source should be updated to name the GitHub repository and define what happens if the two sources differ.
Security and privacy
What data, permissions and controls need testing?
A missed feed means missed driver and AI-software patches; per-file SHA-256 checksums allow integrity checks of downloaded advisories.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Analysts unfamiliar with GitHub or CSAF may need brief training; email subscription remains for smaller teams.
Procurement
What should contracts, pricing and exit terms secure?
Vulnerability management tool contracts should confirm support for vendor CSAF feeds hosted on GitHub.
Operating model
Which teams own the service once it runs?
Advisory intake shifts from reading web pages to ingesting machine-readable files.
Publication history
- 2026-10-06NVIDIA · Issue 319 resources
Stable resource ID: nvidia-product-security-github-readme-bulletins-github-only-20260901