JITter Bug (Linux Journal)

That's a little misleading... their test case was a *crash*, not an exploit; someone used it as a starting point for writing the exploit itself. From reading the history, they probably should have realized that this particular crash might be exploitable about a week ago, but apparently the particular engineer dealing with it was insufficiently paranoid to notice. (As for "going to work on it later", they did have a patch before there was an exploit; the exploit came out while it was going through the review/revision process.)

Great anecdote for future talks on security and disclosure, and I hope they tune their policies better. (I will bet, though, that this engineer won't make that mistake again! Man, I'm glad my errors don't generate news articles.)