I don’t think that’s fair, it does not usually work that way in private industry.

It’s possible they have major findings in crypto but are coordinating disclosure. The PHP bug was worked for months and only leaked a few hours early.

It’s also possible they have not found any major flaws yet. The math underlying major cryptography libraries is way simpler than these advanced proofs, and the implementations among the most scrutinized and hardened bits of code in the world.

The PHP bug paradoxically gave me hope. It was not magic; it was a logic flaw that was already known for years. And exploiting it has proved way more difficult than initially feared.