This is not a technical failure; it's a failure in basic house keeping. For a company that size you would expect processes in place such as a maintained asset register and patch maintenance in place. Not having these controls in place is gross negligence. This is not a small startup we are talking about, this is a multimillion dollar company that can afford a small team to implement basic process driven security controls.

The fix is not a simply apt-get. Upgrading struts can break things and testing and verification takes time... but it's a machine hosted on the internet with troves of customer data... as such I think your being too easy on them.