RAPID7 THROWS JETBRAINS UNDER THE BUS FOR 'UNCOORDINATED VULNERABILITY DISCLOSURE'

Summary from the TLDR InfoSec newsletter

Security firm Rapid7 criticized JetBrains for silently patching two vulnerabilities in TeamCity before public disclosure, violating coordinated vulnerability disclosure norms. Despite Rapid7's policy against silent patching, JetBrains released patches without an advisory or notifying researchers. Rapid7 then published details of the vulnerabilities after JetBrains ignored inquiries.