Honestly, it's pretty disappointing to see responsible disclosure fail like this. It takes a lot of effort to release a critical patch.
Leaking the announcement or publishing a PoC before a scheduled patch shows you have no ethics and are only interested in credit for yourself.
commit 811cff8
It is also frustrating because I don't have control over the servers where my applications run.
Until the patch is out, what can we do, apart from asking the providers?