Many of these flaws are reported to vendors initially, but just as many are not. The release strategy surrounding discovered security bugs depends on the person who discovers the flaw. Some people report the problem to the vendor, some send a warning to public forums like Bugtraq (www.securityfocus.com), some code an application or script to automate the exploitation of the bug, and others do all of the above. The vulnerabilities that are not public knowledge--the ones the vendors are unaware of--will always be a problem. As long as vendors continue to release flawed code, there's very little we can do to protect ourselves (short of not using the product). As a community, we will continually fall victim to these attacks, but we can defend ourselves against known vulnerabilities.