Uh, okay. I thought the embargo date was set so you could have enough time to inform the distros. Not the case, then.

Won't that theoretically allow malicious actors to study the patch and exploit the now 1-day vulnerability?

Not that I think it's realistic to develop an exploit and gain real value in three days, but theoretically, if all parties had taken more than three days to distribute and apply the patches?