The Joomla team is famous (or imfamous) for having oops releases, e.g. a major release, then another minor one a few days later to correct a few issues. That's happened again with 3.6.3 and its immedate followup 3.6.4. We've updated all our client sites to 3.6.4, which patched a long-standing security issue. You can read more details in this official followup.