@kumicota is this a problem with Open source or as it says in the article people using it without contributing financially in some way.

IIRC when the ssh bug was found it turned out the developers' computer had broken and therefore was unable to develop or fix problems till that got fixed.