Hey Jeff, I know it wasn't really "officially" announced other than the security release patch you linked, but isn't this what Nacin was talking about in his Loopconf talk? https://www.youtube.com/watch?v=yQaRUEwEKxE

Whether it was better or worse to discuss a security issue like this in a talk at a conference, and not through more official channels, I'm not sure...