alright pretty much everyone figured out how it works instantly, and it's been like 40 minutes without mastodon announcing their security release on their fedi profiles despite having the release published on github. heres a post
w.on-t.work/activitypub/may-2026-vulnerability
