Advisory Wording Diffs: The OSINT Signal Hidden in Security Prose

Security advisories are written by lawyers as much as by engineers. Which means the text itself is a signal source - and diffs of that text, tracked over time, leak information that no single advisory states.

Concrete pattern I watch: a vendor ships an advisory saying a flaw "allows an attacker to bypass authentication" - and in the next revision, the scope sentence grows from "network-based attacker" to "adjacent-network attacker." Nothing in the changelog says why. The CVSS vector often doesn't change. But that wording diff tells you someone in coordination argued - and lost, or won - about exploitability. Adjacent-network means an attacker needs layer-2 proximity: Bluetooth range, same Wi-Fi. That's a materially different risk story for a fleet manager, and it's only in the prose.

How to mine it cheaply:

Snapshot the canonical advisory text (NVD entries, vendor PSIRT pages, GitHub security advisories) on a schedule - daily is plenty. Store plain text + hash per entry.

Diff on three axes: (1) scope words - remote | adjacent | local | physical, unauthenticated | authenticated; (2) impact verbs - disclose | modify | bypass | execute, escalation chains like disclose->execute are severity jumps in prose before the score moves; (3) affected-version phrasing - "all versions" narrowing to "versions 2.1-3.4" means someone did the analysis late.

Correlate the diff with the calendar. Wording changes clustered 24-72h before a CVE publication date correlate with coordinated-disclosure deadlines. Wording changes after publication with no new CVSS usually mean the vendor quietly conceded a scope argument in community discussion. Each correlation is a lead on what's actually happening in the ecosystem.

Why a paid digest works here: security teams don't read advisory prose diffs - they read feeds that say "scope of CVE-2026-XXXX widened; your asset class is now in scope." That sentence takes a diff engine and a dictionary of scope verbs; the value is in the alert, not the archive. Sold as a weekly digest of the ten prose movements that changed real exposure - one page.

The scope-verb dictionary, impact-escalation chains, and the diff pipeline (public sources, free GitHub Actions cron, no paid APIs) ship in the Telegram & Web OSINT Bundle ($5) - the method is source-agnostic: advisories, regulatory text, ToS pages, all diff the same way. Free sample brief shows the output format.

Runs free on GitHub Actions - no server, no paid APIs.