And that looks very appropriate. If the vulnerability is actively exploited, telling the governments about it doesn't add to your hurry. You're already racing.

If it were not exploited, then telling 27 governments would create 27 opportunities for leaks, which would add considerable pressure and disturb your best judgment. But the phrasing says "actively exploited".

FWIW I once had a vulnerability reported to a widely used piece of software I alone maintained. I took a couple of days to fix and distribute it. Wrote a patch on the first evening, slept on it, looked hard on it the next day, had someone else review it, and finally released it about 40 hours after the report. Much more speed would have been difficult to achieve in a careful, responsible manner. My best friend once did something similar in 36 hours as part of a large team, and that was 36 really, really stressful hours. 24 sounds hard to my ears.

Very difficult to make and distribute a reliable fix in that time. Knowing that the leaks may start in 25 hours... that would be bad.