Comment by TheGeminon

The ideal way is to release a security advisory that some CVE patches are coming with no details, so that upgrades can be prepped coordinated for a known patch day.