A rumour of a bug is now enough: probes arrived ten minutes after the patch was discussed

OCaml maintainer and Cambridge professor Anil Madhavapeddy opened a pull request fixing a path-traversal issue in cohttp, where resolving a local file no longer escapes the docroot on percent-encoded traversal sequences. Within roughly ten minutes his live webserver logs were fielding probes for exactly that pattern. rclone’s Nick Craig-Wood reports more than 40 security disclosures in a single month against about 20 in the prior decade, and reckons roughly 75% carry "a nugget of something which needs looking at". CVE assignment has stretched from two or three days to three or four weeks, so maintainers are shipping releases marked CVE-PENDING.

What it means Coordinated disclosure assumes an attacker needs the patch. If the public discussion is enough, the embargo window your project plans around has already closed.