The good news is, if you emergency patched your Debian for php2shell, you probably got the new kernel on the same apt run. This time the embargo actually held, and the new kernel was out before the CVE came public
At work we currently have a weekly release schedule but im going to push to speed it up because 1 week is far too long to leave packages out of date.
How does this cycle get broken?? Will people ever be able to be sold the (false idea) that their devices are secure?
The implications are extensive.
The models that many organisations and most individuals don't have access to?
Random npm packages are another thing.