Assuming you want to know when the update was really applied to your system, e.g. to check if the security fix was applied on time before the exploit was active in the wild:
If you are using drush for your updates and didn't delete recent folders, and didn't do any additional updates of your site, you can look up the last core update in your drush-backups folder. The updates have a timestamp in the folder names
e.g. in linux
find ./drush-backups/<site-name> -name "drupal" -type d
or
find ./drush-backups/<site-name> -name "modules/<module_name>" -type d
for a module update.
Otherwise you have to resort to the file modification attributes of the file-system, which might show write access from after the update.
To get the information in php you could try to use the php function filetime https://secure.php.net/manual/en/function.filemtime.php on the CHANGELOG.txt file. This file should be updated with core each time, even if the content is not up to date.