Yes - if you go by the iOS 12.1.1 security notes, for instance https://support.apple.com/en-us/HT209340 https://support.apple.com/en-us/HT209340 , it appears th

Yes - if you go by the iOS 12.1.1 security notes, for instance https://support.apple.com/en-us/HT209340 https://support.apple.com/en-us/HT209340 , it appears that CVE-2018-4435 was discovered independently (on the same day, even!) by TrendMicro / ZDI https://www.zerodayinitiative.com/advisories/ZDI-18-1365/ https://www.zerodayinitiative.com/advisories/ZDI-18-1365/ and Google Project Zero https://crbug.com/project-zero/1671 https://crbug.com/project-zero/1671 , whose reports don't mention each other. CVE-2018-4438 is also credited separately to both Qihoo and Project Zero, and the P0 report https://crbug.com/project-zero/1649 https://crbug.com/project-zero/1649 again doesn't mention Qihoo. I've seen this sort of thing with some frequency in previous update reports. Also, somewhat famously, both Spectre and Meltdown were discovered independently by multiple teams in the same timeframe, who all coordinated disclosure with the CPU vendors etc. https://meltdownattack.com https://meltdownattack.com