Releasing a statement that a critical security bug exists with no more information, does the opposite of preventing rumors. I think one of the most surefire ways of generating rumors is to say "something big will happen tomorrow, please don't speculate about it".
replyAnyway, GPs point is that even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently. So what is the purpose of waiting 24h before releasing the patches?
That’s also a take based on nothing.
replyI can say with high confidence that Nginx, Apache and IIS have a critical security vulnerability hidden somewhere in their codebase right now.
Please provide the prompt that uncovers it. Apparently knowing about the existence of bugs is enough nowadays right?
I’ll wait.
Yeah I don’t really get this, the rumor “there is some exploitable vulnerability in php” can’t really be the problem, because that’s probably known to everyone already. The rumor only helps you exploit it if there’s some specific hint how the exploit works.
reply