There was a KB article #106630, which was for Syracuse 11.22.4.1, which was a hotfix for 11.22.2.1 and addressed the & being replaced with &. But now that KB article no longer exists.
If you search the KB for Syracuse you'll find the original security…
