The only party that's sure to know the vulnerability and exploit is the exploiter. On the day the software vendor/operator learns that the vulnerability and/or

The only party that's sure to know the vulnerability and exploit is the exploiter. On the day the software vendor/operator learns that the vulnerability and/or exploit exists, the vendor may not know much more than "a vulnerability exists" (e.g. if the vendor discovers it by seeing data exfiltration). Who would you require, by law to inform people?