but that wasn't where he disclosed the vulnerability, right?

it was in the subsequent one a few weeks later. the first post is erroneous