I disagree with the fatalist tone. Sure, it can be hard for big, slow moving businesses to take a time out from writing million dollar checks to C-suite executi

I disagree with the fatalist tone. Sure, it can be hard for big, slow moving businesses to take a time out from writing million dollar checks to C-suite executives to spend money on a competent operations and security team. But it can happen and in this case it should have happened. I don't think "better architecture" is handwavy. If you have old legacy apps that can't be updated and maintained, don't provide them with a path to the public internet. Or front then with some infrastructure and adequate alarms to detect something going wrong. I think it's reasonable to respond to a CVE with an update to your app or infrastructure within one week. Most of the time rapid testing will be fine as your patching a library or component, like Struts or Tomcat. These companies are hardly providing 100% uptime, in the case where an update like this needs a rollback, it won't be a big deal. If you have a good team and you spend the money on them.