We learned of the scanning bug in early December, but because it affected a wide range of our products, we wanted to release a fix for all (of the affected versions) at once.
Although the WMF bug is there (in the older versions), there's no known code at the moment to exploit it.