There was already a third party that found the exploit before it was reported. It's clear that it was essentially not a secret anymore.