The good news is, if you emergency patched your Debian for php2shell, you probably got the new kernel on the same apt run. This time the embargo actually held, and the new kernel was out before the CVE came public
The only way to survive is to just update everything daily or faster.
At work we currently have a weekly release schedule but im going to push to speed it up because 1 week is far too long to leave packages out of date.
loading story #50321500