An HP bug bounty program has published information about a critical vulnerability in Internet Explorer 8 because Microsoft did not meet its patch-or-we-go-public deadline.