[daviddede]

It depends on the complexity of the attack. This Drupal one took our team less than an hour to have a working proof of concept (just based on the diffs).

The exploit is very simple, and doesn't require any interaction with the remote site. Explaining why they started on it very fast.

On other more complex exploits, we generally see days (if not weeks), before the attacks start.