I'm not sure if such a promise ever existed. After all, before CentOS Stream, all security fixes went out with RHEL first and were imported into CentOS (non-Str

I'm not sure if such a promise ever existed. After all, before CentOS Stream, all security fixes went out with RHEL first and were imported into CentOS (non-Stream) only afterwards. And under the Stream development process, the fixes have to be merged into Stream eventually for the next minor RHEL release, otherwise they would be missing from that, too. The CVE tracking pages are here: https://access.redhat.com/security/cve/CVE-2023-0590 https://access.redhat.com/security/cve/CVE-2023-0590 https://access.redhat.com/security/cve/CVE-2023-1249 https://access.redhat.com/security/cve/CVE-2023-1249 https://access.redhat.com/security/cve/CVE-2023-1252 https://access.redhat.com/security/cve/CVE-2023-1252 Based on these data, it seems that the commercially supported versions are still unfixed (if they were impacted in the first place). Bugzilla records show that the corresponding security tracking bugs were filed publicly from the start: https://bugzilla.redhat.com/show_bug.cgi?id=2165741 https://bugzilla.redhat.com/show_bug.cgi?id=2165741 (CVE-2023-0590) https://bugzilla.redhat.com/show_bug.cgi?id=2169719 https://bugzilla.redhat.com/show_bug.cgi?id=2169719 (CVE-2023-1249) https://bugzilla.redhat.com/show_bug.cgi?id=2176140 https://bugzilla.redhat.com/show_bug.cgi?id=2176140 (CVE-2023-1252) So the Neowin headline is a bit misleading because Red Hat disclosed these issues publicly (presumably after consultation with the reporters) even before the 90-day timer expired in the Google bug tracker. (Disclaimer: I work for Red Hat, but are not involved in security anymore.)