TimeWalker

Plex is a closed source software, so it’s easier to just push an update and tell about this later. PHP is open source, so if they release a patch for it, you can immediately look up in the source code and find out what has been fixed and kind of reverse engineer what the problem could be.

As this is a very high-class vulnerability, I assume that it’s very easy to get into this so if you see the patch, it’s probably trivial to just find out what the issue is and immediately start attacking everyone. With this, at least most admins are ready and can plan in that on this time they should check into the issue and patch asap.

Here’s the thread about the db-version and the change log for the db-version branch

As I understood, the one that you see on the page is something distinct. They have a different service on their ACME page. If you’re using a script like acme.sh or using the ACMEIssuer in Caddy, then you can get a free wildcard certificate over that. But I assume it’s losing the advantages that have been mentioned like the web dashboard, etc.