Can you give him some slack? It's sunday, he says the vulnerability is fixed and this is all you should care about. Surely you would rather have him looks if it's really fixed rather than issuing an official statement. Surely an official statement can wait a day or two no?