Comment by jwitthuhn
17 hours ago
They didn't release the patch out of fear that someone would quickly use the patch to develop an exploit, meaning an exploit is available shortly after the patch.
What they have achieved by delaying the patch is that exploits are now available publicly before a patch.
Surely this is the worse outcome.
Also they could’ve sent patches to at least some trusted members/maintainers/distros/hyperscalers/big Hosters/plesk/cpanel. It would’ve been easier to make some kind of coordinated release.
Also not announce it beforehand…
It sounds like they may have done that, and that is part of how it leaked.