It feels like they waited a long time to post an advisory for an exploit that was being actively used by threat actors, more than a week after they pushed a fix to their repositories. Why not give customers a heads up prior? At least give your users a fighting chance.