> Does anyone have context for why "best practice" would be to disclose before there's a fix available? If it is already being exploited is one reason. A fix

> Does anyone have context for why "best practice" would be to disclose before there's a fix available? If it is already being exploited is one reason. A fix may not be available, but if folks know there's an attack going on, they can make a more informed choice in still whether to allow the code to run: in some cases a loss of service would be better than a compromise. If the code is externally-facing, then they bring it down; if it is internal-only, then it may be judged that the risk is low(er) and things to be continue to be run (and a maintenance window can be pre-planned for when the fix comes out).