Should have been patched within 8-12 hours. Anything more is unacceptable.
Turn off message previews and banners in notifications and, for the time being, the problem is solved. Without knowing everything involved with regard to the problem, or what a proper fix would entail, we simply cannot assume a proper time frame for a fix to be released. Saying someone "should have done such and such" without knowing all of the information is nothing more than a ill-conceived judgement call.