At the same time it allows exploit writers to quickly add this to their kits.
I'd expect AV vendors to already have signatures for this given that it's being actively exploited, which means there must be malware samples to know this.
I'd expect AV vendors to already have signatures for this given that it's being actively exploited, which means there must be malware samples to know this.
When there are known exploits attacks against users, giving a short time to get out quick patches to trusted software vendors makes a lot of sense, but I don't see a good reason for giving more than 24-48 hours before public disclosure.
In this case, the exploit was being actively used in the wild. That means bad actors already had access to this and it was the users who were in the dark. Now it may be added to the "toolkits" of scripters and people who buy exploit frameworks but the people who do real damage were already using it according to Google.