Re:Disclosure of Additional Security Fix in WordPress 4.7.2
by fencepost on Thursday February 02, 2017 @11:13AM
(#13551582)
Is that "wait longer" referring to the difference between "over the weekend" for WAFs and "Monday" for WordPress hosts? Because I didn't get the impression that the companies that got advance notification were chosen based on being partners.
They had to balance the question of getting as many installs as possible protected before doing the easy-to-analyze release, because probably within hours after the release there were going to be attacks starting to turn up. In the meantime, as long as they had feedback from the WAF vendors that the vulnerability wasn't being probed they had a pretty good idea that it wasn't widespread.
The only real question about it that I was curious about as well is which firewall plugin developers they communicated with.
They had to balance the question of getting as many installs as possible protected before doing the easy-to-analyze release, because probably within hours after the release there were going to be attacks starting to turn up. In the meantime, as long as they had feedback from the WAF vendors that the vulnerability wasn't being probed they had a pretty good idea that it wasn't widespread.
The only real question about it that I was curious about as well is which firewall plugin developers they communicated with.