I think it's worth to note that the error was known since some more weeks now. Originally it was reported by caesarsgrunt in #11236. I've the full story in my blog post "The short memory of WordPress.org security". Just for the info.