3 ms·

If I understand correctly, the article was published only after the vulnerability was patched. That sounds OK to me.