I agree. They could and IMHO should have given a disclosure window since there was no evidence of active exploitation. However it wouldn’t be that difficult to

I agree. They could and IMHO should have given a disclosure window since there was no evidence of active exploitation. However it wouldn’t be that difficult to actually execute this attack. It’s not that difficult to spoof the DNS server or even DHCP responses on public wifi networks (or local LANs). Yes you can setup enterprise networks to detect or block that but plenty of people aren’t on enterprise networks: https://charlesreid1.com/wiki/Ettercap https://charlesreid1.com/wiki/Ettercap It’s also easy to stand up wireless SSIDs of common public networks (eg “Apple Store”) and have devices preferentially connect to you if it happens to be earlier in the wifi network order list. You can also steal all of a machines traffic by plugging a USB network adapter in: https://github.com/samyk/poisontap https://github.com/samyk/poisontap Working SSL would prevent all of that auto running a downloaded executable by such a boot chain.