@cR0w@infosec.exchange Yeah, giving major sites the worry that someone _might_ have an explot without any mitigation sucks. And a head-start for people to look for the vuln without a fix available to anyone else also sucks. OTOH releasing the fix releases the vuln so automated exploit-tools will have RCE available while everyone else is busy patching. Which is why I am torn...