What is meant by "releasing code tells the hackers what to attack"? I came across this statement from a SolidCoin developer:

Can anyone explain this statement? 


  [06:48] gavinandresen: I came here to ask RealSolid to be responsible
  and report problems or vulnerabilities to the core bitcoin dev team
  before releasing code that fixes the exploit (because releasing code
  tells the hackers what to attack).  RealSolid, I'll ask again:  are
  you willing to do that?


The user "Gavin" asked RealSolid to first report vulnerabilities and only then fix them, because "releasing code tells the hackers what to attack". The conversation is archived in this chat transcript.
It would appear that Gavin is advising against providing zero-day attack vectors. 

Essentially, if someone gives fairly precise instructions (e.g. a code sample) on how to exploit a vulnerability then anyone monitoring that discussion can exploit it. This is the zero-day exploit because no-one has had time to react, create an appropriate patch and disseminate it widely. Until the patch overtakes the exploit then the affected systems are vulnerable.

Consider the famous "Java Double of Death" (see http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ for details, Oracle fixed it here http://www.exploringbinary.com/fpupdater-fixes-the-java-2-2250738585072012e-308-bug/). 

Imagine if a malicious coder decided to put that magic number into a request against your web API that and exploited the fact that you haven't patched your JVM? You'd be seeing an awful lot of unexplained JDK downtime and lost business.

There is a fair amount of discussion about this topic over on Security StackExchange which references this Wikipedia page about responsible disclosure.