Where Systems Meet People
The HFS bug was public for 11 weeks. The write-up got it exploited in a day.
The Rejetto HFS flaw was described in a public CVE in July and nobody reported exploiting it. A detailed walkthrough went up on 30 September. Attacks started the next day.