I want to understand the process to go from a security bug report to a running system having the bug fix applied. Especially how long it takes from the bug being public until the bug is fixed on the running system. I heard it only takes 1 hour from a bug being public until hackers use exploits to attack running systems.
Let's take PHP as example and debian (server version) is the OS which is running PHP stuff.
I think first the bug is reported to bugs.php.net first and marked as a security bug so it's not public.
Then someone from the PHP team creates a bug fix.
But then I don't know any further. It might be the bug fix is applied to a private security repository. But I am not sure. See PHP wiki
What happens next? Do debian package maintainers get the fix before it is public? So they can apply it before hackers do know of the bug?
How much time does pass from the bug being public until the fix is available in the apt repository?
How much time does pass until debian downloads the fix (the new apt package) automatically? Is it possible to get real-time updates?