> As a result, we have begin the process of rotating all customer SSL keys/certificates.

AGHHHHHHH! Even if their code was likely to have worked perfectly, this is a huge mistake. And I mean huge. They should've operated under the assumption that their defense didn't work and immediately rotated all keys. Period.

They used their patch for some length of time, release it to the community and a few hours later a bug is spotted and fixed. Peer review is a good thing.