Just the rumour of a bug is enough to find an exploit these days

The author released a security fix for OCaml's cohttp 6.3.0, but noticed probes in live webserver logs with the exact bug pattern just minutes after opening the PR to fix it, indicating automated exploit generation is now possible within seconds. The traditional security process needs to be inverted to prioritize private patch development and rapid release over secrecy of details. [summary]…