arXiv:2605.03158v2 Announce Type: replace Abstract: Cyber threat intelligence (CTI) systems must link exploit code, advisories, and fix commits to the vulnerabilities they concern, and they must do so for vulnerabilities disclosed after training. HackerSignal is a public corpus and benchmark built for this prospective setting. It aggregates 7.45 million exact-deduplicated documents from 64 public sources across eight source layers (hacker forums, exploit archives, exploit question-and-answer sites, vulnerability references, advisories, bug-bounty disclosures, fix commits, and known-exploited-vulnerability records), spanning 1988--2026. All layers are keyed to a shared CVE identifier space with source provenance and release-mode governance. We define three benchmark tasks with temporal splits: (1) CVE linkage retrieval over 340,536 National Vulnerability Database descriptions, (2) exploit type classification into eight classes, and (3) temporal generalization, where training and test CVE sets do not overlap ($C_{\rm train} \cap C_{\rm test} = \emptyset$). Zero-shot dense and hybrid retrievers reach a mean reciprocal rank (MRR) of 0.71 on Task 1, and the top models are statistically tied under paired bootstrap tests. Cybersecurity-pretrained encoders lead exploit type classification (macro-F1 0.90). A two-annotator audit of 240 linkage labels finds 79.5% precision (Cohen's \k{appa} 0.94), with per-source precision from 20% to 100%. The hacker-community layer contributes 6.97 million posts but only about 2,000 CVE-linked records. A masked forum-post grounding pilot over these records reaches MRR 0.08, about nine times lower than the structured-source tasks. Grounding informal hacker discourse to vulnerabilities therefore remains an open problem that the release is designed to support. Code, data, and Croissant metadata are available at https://huggingface.co/datasets/BenAmpel/HackerSignal and https://github.com/BenAmpel/hackersignal.