alt Hacker NewsThis is why I like to have a minimum age requirement on package releases. Something like at least 2 or 3 days.
Replies
talon8635 • today at 9:48 PM
lol this is the exact scenario where that’s an well idea. Maybe the patch is bad, but not patching for 2 days means your guarantees to be hit by the original issue
We are damned if we don’t and (often times) damned if we do
To be clear they said it “still works” and “ ok thinking more about this, there's no way this is the same vuln, this is another one.”
Meaning this specific bug the parent comment is talking about is not new in just these patched versions from today.
So delaying your updates today would mean you’re exposed to an actively exploited RCE and still exposed to the other memory corruption bug (which may or may not be an easily exploitable RCE) for an entire 2 or 3 days.
And from the sounds of it people are very actively exploiting this so waiting 24+ hours will practically ensure you’re hit.