This is how you do a security alert. Notify the manufacturer of the software, notify the press so it is made public and thus people will install updates, and keep the details secret until it's fixed. Kudos to the discoverer.
Unfortunately, it's not so simple. Alerting the public before a fix is out is a double-edged sword: it also means malicious attackers have a chance to replicate the finding and abuse it.
