Shutting down half the internet was the right move. If it took someone 19 hours to exploit a site, you'd better have shut it down before 19 hours and not after.

I don't see what was confusing about the initial 24 hours. GP was correct, the description of the bug made it clear it was a very high risk.