“Urgent warning about imminent security patches mitigates an unconfirmed remote code execution risk without sensationalizing panic.”