

No, they disclosed it to the Linux kernel security team, a patch was committed to mainline, then this was disclosed publicly. https://copy.fail/#timeline
They don’t have to coordinate disclosure with every distribution vendor, but droppings public PoC exploit script 28 days after the patch was committed to mainline kind of seems like a dick move to me.


WhatsApp’s code is not public. The app generates the private keys. The app has to have access to the private keys to decrypt your messages. Because the code is not public, no one has any idea if meta has ad hoc on demand access to the private key, or if they upload the private key to their servers.
If WhatsApp was open-source like signal, we wouldn’t be having this conversation. Until then, and based on metas know business practices, it’s safe to assume they have access to WhatsApp private keys.