I have two WordPress websites with a mid-range managed host, which I prefer not to mention since the post is not about them.

It has been two times now (v7.0.2 and v7.0.4) that I read a headline “critical security fix just released, update immediately”, I go to the updates section of the host control panel to check if the auto-update has been applied, but two hours after the official release still nothing and I have to make a backup myself and update manually from the wp dashboard.

I am mildly irritated by this delay, since I have set the minor auto-updates to “immediately” but it takes hours instead, and especially with v7.0.2 the vulnerability was being exploited very quickly.

Is that delay normal?

How long does it take with your managed hosts for the auto-updates to be applied after the official release?