Rumours look to have been accurate, it looks like it's CUPS:
Benjamin Harris on LinkedIn: 15 minutes ago, our monitoring systems went off - the widely discussed but… | 19 comments
15 minutes ago, our monitoring systems went off - the widely discussed but embargoed unauth Linux RCE details were accidentally leaked by a CUPS package… | 19 comments on LinkedIn
(www.linkedin.com)
(Courtesy of an old friend at @watchtowrcyber)