“An attacker in possession of a few dozen signed messages and the public key has enough information to recover the private key”
PuTTY 0.68 through 0.80 hashed with SHA-512 and reduced mod a 521-bit q, so every nonce came out with its top 9 bits zero. Around 60 signatures is enough to rebuild the key. PuTTY rolled its own deterministic scheme in 2001 and kept it after RFC 6979 standardised the job in 2013. Every P521 key ever used with PuTTY or Pageant is burned, and the patch can’t unleak a single one.