> No real company can do this. 1-2 weeks after the announcement is the best you'll see

You don't need to patch your software right away, but you should have other strategies for mitigation such as a WAP in front of your services that you can configure to block malicious traffic when you identify a remote code execution vulnerability.