Views on Apache’s latest vulnerability

Tell us what you think about the latest Apache vulnerability, as featured in the latest Internet Security Focus e-newsletter. Were you surprised to learn that security problems exist in open source software? Why or why not? What’s your take on how Internet Security Systems notified the public about the vulnerability? Do you think they should have allowed Apache to develop a fix for the problem first?