The timeline says the CVE was reported over 2 weeks ago, so why are the alarms sounding now?

Anthropic published a blog post claiming RCE with it [0].

[0]: https://www.anthropic.com/research/discovering-vulnerabiliti...

Which was 4 days ago.