I think I speak for us all when I say ???????!!!!!!!. This exploit is as big as they come. They should have paid him many times their $10k maximum bounty in exchange for an NDA, as I am sure I am not alone in saying that this shakes my confidence in PayPal. While I have never trusted them as far as random account freezings etc., I didn't ever expect something as fundamental and serious as this. When you think of all the engineers they must have dedicated to security, it is almost unfathomable that this was missed.