I don't quibble with your wanting to make money, but you also need to invest some resources on fact-checking, proofreading, and editing your work. You can hire technical writers and marketing copy editors on an hourly basis as needed. LLMs aren't good enough yet to produce high-quality output on their own; and the results tend to read similarly, loaded with clichés and identical turns of phrase.

(You're not alone in this, BTW; I don't mean to single you out.)

I would rather people who find this kind of stuff pad their resumes and get coolness points on HN than sell this exploit on the black market. But your priorities may be different and you might prefer they do the latter.

Is it more likely they have no idea what version RHEL is on, or that it's just a typo?

I don't know what to tell you. I'm sure you have them dead to rights on Linux distro knowledge reliability, but the exploit here is real, and the vulnerability researchers they have on staff are also real. Xint is not generally a slop factory.

It's ironic that the one thing LLMs can't do reliably in this space is "write copy for humans" (I don't trust them for that either).

There is no one accepted set of norms on disclosure. Any strategy you take, someone will criticize.

I don’t know if “cool” is the word I’d use, but there isn’t an established “right” way to disclose a vulnerability that you found outside of a contracted security review or other employment/contracting arrangement.

mainline was patched a month ago