Half-life means what it usually does: time until 50% of the thing (vulnerable clients) have evaporated. You can plot out a decay curve. Vulnerabilities are va

Half-life means what it usually does: time until 50% of the thing (vulnerable clients) have evaporated. You can plot out a decay curve. Vulnerabilities are valuable when many clients still exist which can be profitably exploited. The half-life of this bug is ~0. As soon as Facebook becomes aware of it, it is nearly instantly fixed everywhere. This is very not the case if you get e.g. code execution on a version of Java which will take 50 months to completely disappear from the wild.