BMC Patrol has a critical remote exploit that needs to be patched. Not the most exciting news, but what I did find interesting was the attitude/tone of their announcement:

[This issue] has been addressed, and a patch has been made available to our customers. A flash bulletin has been created describing the patch and will be sent to all affected customers in the next few days.

So far so good, right? Then something odd happens.

BMC has a formal customer support mechanism in place to provide solutions to security issues brought to us by those who have legally licensed our software. In cases where security issues are brought to my attention by individuals/vendors who do not have legal access to our products, we will investigate their merit; however the issues will be addressed at our own discretion and according to our understanding of their severity.

Finally, please note that in the future, I will only communicate resolutions and workarounds to licensed customers who are using our software legally. For a more meaningful dialogue around these issues and to be notified of any available patches, I urge all licensed customers to use BMC’s support mechanism.

They are taking their ball and going home now.

If you want to try and tell them about a critical vulnerability, then you had better be a licensed user or they will pretend you do not exist.