The security industry has a vested interest in spreading fear and panic. That's how they make money. But, to be fair, some of it may be necessary to motivate people to patch their stuff, so there could be good intentions behind it also.
In this specific situation, a lot of misery could have been prevented had the embargo not been broken. That's the crux of the issue: Chainguard's and Calif's incompetence and irresponsibility. Had the patch been out at disclosure, people could have updated quickly and wouldn't have had to choose between downtime and an unspecified risk of getting pwned.
In this specific situation, a lot of misery could have been prevented had the embargo not been broken. That's the crux of the issue: Chainguard's and Calif's incompetence and irresponsibility. Had the patch been out at disclosure, people could have updated quickly and wouldn't have had to choose between downtime and an unspecified risk of getting pwned.