My guess would be Tuesday or Wednesday. Apple has to give developers time to test the Bash 4.3.5 version on any software that requires its use to make sure it doesn't break something mission critical in a UNIX application, say in a medical surgical suite, before pushing it out in a security update. Apple doesn't have the luxury of just tossing it out in the wild without checking. . . especially after the iOS 8.0.1 fiasco.
“. . . especially after the iOS 8.0.1 fiasco.”
Guess I missed it. What was the iOS 8.0.1 fiasco?
Yes, I thank goodness I just happened to see information about the mess with that before I downloaded and tried to install it!