They took a lot longer than that on some past vulnerabilities, some of them sat unpatched for weeks or months. But it depends on the severity. A remote exploit of severity 9 will probably get expedited.
Comment on PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)
Natanox@discuss.tchncs.de 16 hours ago They took just a few hours to squeeze out a new ca-certificates. On the other hand the last time there was a huge kernel bug it took well over 24 hours…
lemmyvore@feddit.nl 13 hours ago
slazer2au@lemmy.world 15 hours ago
A bad ca is update a file on every pc and application. A kernal bug is way more involved so it doesn’t make a new problem later.