After the research started attracting attention last week, ServiceNow quietly released a second fix for the issue that set all blank ACLs to disallow public access by default.