On: Security advisory: Critical remote code execution vulnerabilities, update now

Also they could’ve sent patches to at least some trusted members/maintainers/distros/hyperscalers/big Hosters/plesk/cpanel. It would’ve been easier to make some kind of coordinated release.

Also not announce it beforehand…

It sounds like they may have done that, and that is part of how it leaked.