isn't that a normal timeline for critical vulnerability? Seems like paid marketing