  Breaking cybersecurity events are shared across a range of websites,
including security blogs (FireEye, Kaspersky, etc.), in addition to social
media platforms such as Facebook and Twitter. In this paper, we investigate
methods to analyze the severity of cybersecurity threats based on the language
that is used to describe them online. A corpus of 6,000 tweets describing
software vulnerabilities is annotated with authors' opinions toward their
severity. We show that our corpus supports the development of automatic
classifiers with high precision for this task. Furthermore, we demonstrate the
value of analyzing users' opinions about the severity of threats reported
online as an early indicator of important software vulnerabilities. We present
a simple, yet effective method for linking software vulnerabilities reported in
tweets to Common Vulnerabilities and Exposures (CVEs) in the National
Vulnerability Database (NVD). Using our predicted severity scores, we show that
it is possible to achieve a Precision@50 of 0.86 when forecasting high severity
vulnerabilities, significantly outperforming a baseline that is based on tweet
volume. Finally we show how reports of severe vulnerabilities online are
predictive of real-world exploits.
