@alsalahad and the Project Zero finding was communicated back in April, and either got rediscovered independently, leaked, or Bugzilla or a developer device got broken into. Ouch.