thenaderman

Bit surprised our old keys have not yet been revoked, apparently due to letsencrypt rate limiting? Wonder how many thousands of private keys they store on a CDN node

What an incredible irresponsible move essentially 0-daying everyone who was working toward coordinated disclosure to ensure everyone had images or distro packages to update to.

This is nonsense, disappointed to see that publicly from a core dev. Yes, some people are asleep, but the decision was made to wait, to ensure the patch is only made available when users are actually able to install the update and we're giving distros the time to build PHP packages.