[Yanu-3452]

If I had to guess between "Inside job" and "Their CI system was owned", it may be neither, of course, but of the two I'd bet on the latter.

[danielvf]

In this case they had publicly posted the bug fix on GitHub hours before the attack.