Zero announcement / advisory notice / blog post or any indication of the vulnerability on BTCPay Server's website other than the post on X.

It has been 4 hours.

If this is how they operate, I advise you all to just pull the plug and shut your BTCPay instances down.