"zerodium investigated zerodium and zerodium found out that zerodium had nothing to do with this"

That's unknown, but it would be strange for them to be involved - it would not make much sense for them to pay out a bounty to themselves.

I think it's far more likely that someone tried to plant this there in order to cash out via zerodium.

I believe the exploit itself was introduced with the commit in question, it wasn't there before.

That was my assumption given that they explicitly mentioned zerodium. But so far only the commit itself is public, so until we know more about the attack or the attacker, this is pure speculation. The tweet from zerodium is not clear on whether they received an offer for this vulnerability, unfortunately.

twitter. the takes are hotter than the sun, the style is snarkier than zkSNARKs.