This would be extremely significant. China implemented a similar law in 2021 requiring security researchers to report zero day vulnerabilities to both the software vendor and the Chinese government. It was followed by an absolutely massive explosion in zero day use by CN state sponsored groups.
I suspect it not only lead to a huge increase in the number of zero day exploits China was in possession of, but also their calculus on how and when to use them.
Normally, zero days are used very sparingly. There is always a risk they will be detected and patched. However, if the vulnerabilities are being simultaneously reported to the vendor and the intelligence services, they're getting patched anyway. There's very little downside to using them, and only a small window to do so.
I can't say 100% the legislation change is what caused the changed in behavior, but since then, there have been many documented cases of Chinese APTs using high value zero day exploits to indiscriminately hack systems. Not just high value targets, basically anything with an internet connection.
https://risky.biz/risky-bulletin-russian-bill-would-require-researchers-to-report-bugs-to-the-fsb/
Marcus Hutchins :verified:
npub1t5…338yv
2025-10-28 00:55:13 UTC
Author Public Key
npub1t5y3qpya5m4v4tv73yw447uglfsn7j44znv2d38m2xsrah4kpm0qt338yvPublished at
2025-10-28 00:55:13 UTCEvent JSON
{
"id": "284ac059740841193c0205bbc151c770537f0375ff904ce4966966e16d5a4d2a",
"pubkey": "5d0910049da6eacaad9e891d5afb88fa613f4ab514d8a6c4fb51a03edeb60ede",
"created_at": 1761612913,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/malwaretech/statuses/115449063900155112",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub/"
]
],
"content": "This would be extremely significant. China implemented a similar law in 2021 requiring security researchers to report zero day vulnerabilities to both the software vendor and the Chinese government. It was followed by an absolutely massive explosion in zero day use by CN state sponsored groups.\n\nI suspect it not only lead to a huge increase in the number of zero day exploits China was in possession of, but also their calculus on how and when to use them.\n\nNormally, zero days are used very sparingly. There is always a risk they will be detected and patched. However, if the vulnerabilities are being simultaneously reported to the vendor and the intelligence services, they're getting patched anyway. There's very little downside to using them, and only a small window to do so.\n\nI can't say 100% the legislation change is what caused the changed in behavior, but since then, there have been many documented cases of Chinese APTs using high value zero day exploits to indiscriminately hack systems. Not just high value targets, basically anything with an internet connection.\n\nhttps://risky.biz/risky-bulletin-russian-bill-would-require-researchers-to-report-bugs-to-the-fsb/",
"sig": "afb7bd10af28e5ee6d13ba1c83225dae61dab42973835bb46af4ec3cfbb348eb37a1982d561940d4fe79e199b4dca657a918528168be6106cb10ff59fa3ef977"
}