Sometimes they are reported BY publishing the exploit in hacker magazines and on the internet. The system however is very complex, and over time it is changing as software is upgraded, not only fix old holes but also to add new functionality. This inevitably creates new holes. The usual cycle goes something like this. The software is upgraded and published.
Hackers comb through it looking for security problems.
When they find them, if they are good guys, they write exploits that demonstrate the problem or if they are bad guys, that take advantage of them. In either case the exploits become well known on the internet and in hacker circles and eventually make their way to CERT, the world wide Computer Emergency Response Team. CERT then publishes official warnings, with the exploits and the fixes included, and e-mails them to everyone who has subscribed to their mailing lists. It is then up to the respective operators to close the holes and secure their system. This process is a never ending battle.