I subscribe to the Debian security mailing list and get notifications every two or three days, and I have a script that brings all of them up to date on one command. Incidents like this show why it's a good idea to apply updates as soon as possible.