On October 20th, two critical PHP vulnerabilities went public before the advisory did. Unauthenticated remote code execution, CVSS 9.2, and proof-of-concept code already circulating. Unit 42 counted more than 22.6 million exposed instances at the time of publication.

Someone named it PHP2Shell and the name stuck.

The next day, Node.js shipped a security release fixing ten issues. One of them was an out-of-bounds write in the Brotli decoder, which also meant remote code execution. That one got called Node2Shell.

Two runtime-level RCEs in forty-eight hours, in the two runtimes that serve a very large share of the web. Every vendor blog said the same thing, and they were right: patch immediately.

Here's the part nobody writes about. Between reading the advisory and having every service in your fleet actually running the patched runtime, there are hours.…