Same with the recent PHP vulnerability Debian had the patch ahead of time. Ubuntu had it many hours later...