Comment by pxtail

How does it work that some service that most people never heard of distributes (paid) images with alleged fix for vuln 24h before official vuln fix/image is available? Seems somewhat shady.