1) they probably don't get notify 2) they also have interest to say no if isn't being exploited publicly even if they are searching cases internally. In any cas

1) they probably don't get notify 2) they also have interest to say no if isn't being exploited publicly even if they are searching cases internally. In any case the response feels solid most companies will try force update whit vulnerability a and not disclose what the problem was and then blame the public for not have the software update, this giveme security about the compaby, it's also problematic because it drains the the time of the host to update their systems.