Patched. Root cause was a session binding flaw that made token validation weaker than intended. Binding is hardened now. Details restricted.

What was the actual vector? Token reuse, cache poisoning, something else? Any chance normal accounts were affected?

Exploitation required forging session state under very specific timing conditions, so exposure was narrow. Patch is live and all affected sessions were invalidated. Post-mortem will follow.

Got it, thanks for the quick turnaround. I'll keep an eye on my account audit log.

Session binding hardened across all ingress points. No further action needed from members.

Forced logout on the 18th caught me mid-post. Mystery solved.

Good to see fast patch cycles. How long was the window between discovery and fix?

Tried reproducing on a test account — no luck, seems fully patched clean. Anyone else see odd session behavior around the 15th?

Same here, nothing unusual since the patch. All quiet.

Thread locked. No further discussion.