Same issue! I actually thought it might a phishing scheme, that is why I checked the forum and learned it is a real update.
Hard to believe an important security version wouldn’t be automatically updated.
I won’t do the manual download and update until wordpress gives more information and feedback is that it is working ok.
