> The disclosure process was terrible, they clearly had no time to perform a thorough validation of the hotfixes, and this is the result. Even with proper disc

> The disclosure process was terrible, they clearly had no time to perform a thorough validation of the hotfixes, and this is the result. Even with proper disclosure, patching can be harder than it seems at face value. Take shellshock (the bash RCE from 2014) for example, the first patch was released a week after discovery and publication happened after the patch was released. Yet there were still a flurry of further CVEs found and further emergency patches required as a result. The problem is once a major vulnerability is discovered, you then have a the worldwide attention focused on that specific vulnerability looking for other ways to break it. So it’s not really a surprise that you find multiple CVEs for most major vulnerabilities.