It took 2-3 hours, not 19. The first version was a static index.HTML file and was not exploitable. People found out and contacted the challenge author. After the fix was public it has been exploited in a couple of hours.