Actually, the patch was announced before the details of the bug: I subscribe to the libpng mailing list, and got about a day&#x27;s notice to ship the patch out before the CVE and associated details were widely publicised. They did a good job of notifying us quickly, before there was chance for the &#x27;bad guys&#x27; to jump on my customers.