I think VS is monitoring this thread. Coincidental that they released that email 3 months after finding the vunerability and the topic coming up here? My issues happened before and after their stated dates (5/15 and 9/15) so they obviously didn't fix the problem.
They are monitoring here and /r/ecr on Reddit, where I happened to post this the other day. https://redd.it/3obmbk
Which is what most likely drove them to finally fess up. Still, this means they have known since June and told no one, which as moneymike pointed out is pretty illegal.
Last edited: