Intelligent Early Warning for IoT Software Supply Chains: Self-Exciting Point-Process and Hierarchical Bayesian Modelling of Open-Source Security Advisories

Internet of Things gateways, edge controllers and smart-home hubs run on open-source packages, so the advisories published for those packages are the signal that intelligent vulnerability-monitoring systems must interpret.We model that signal as a stochastic process, using every reviewed advisory in the GitHub Advisory Database as of 31 July 2026 across eight package ecosystems.Binary segmentation places a regime change in February 2026, after which monthly volume rose almost fivefold, driven by maintainer-written advisories that now usually precede the National Vulnerability Database.A modulated Hawkes process, estimated by expectation-maximisation, separates batch release from triggering and finds that nearly half of advisories arrive in same-hour batches, while self-excitation between batches is weak (branching ratio 0.05, half-life eight hours).Risk is concentrated.Advisories per package are heavy-tailed (exponent 2.14), and a beta-binomial empirical Bayes model concentrates the 12% of unpatched entries in a small set of packages.IoT-related packages carry more Critical advisories (22% against 13%) and more unpatched entries (18% against 12%).An adaptive early-warning score derived from the fitted process anticipates follow-up disclosures within seven days with an AUC of 0.75, equal to the strongest heuristic and interpretable, although its probabilities run low during the surge.