RE: https://digipres.club/@foone/117514673123344759
This blew my mind reading it. Not the bug. I think I'm numb to that now. The timeline. The company had a 2 month lead between releasing the patch and posting the advisory. And an additional 2 weeks before the blog post broke the news.
This company had like 3 months of cover to deploy their patch. Absolutely insane.
As nice as that sounds for the company, anyone could have read the release notes, wrote an exploit, deployed it, and all the users diligently watching they CVE notices and security mailing lists would be none the wiser...