You follow every best practice: repeatable environments, patch-on-command pipelines, zero technical debt. Your security processes are clear, rehearsed, and reliable. The moment a zero-day drops, your team is ready.

Except none of that mattered.

When php2Shell hit, IT teams had almost no time to react, and no patch available even if they could. It was a CVSS 9.2 Remote Code Execution vulnerability, and the clock was ticking down. Mass exploitation wasn't days away; it was minutes away.

The only move left? Turn it off. Disable it. Shut it down.

It’s a blunt instrument that engineers hate to use, but it works. Taking the site offline immediately kills the exposure window, buying the crucial time required to write, test, distribute, and deploy a proper fix.

Yes, patch early, patch often, and patch fast. But when the ground starts burning beneath you, don't hesitate to pull the plug first and ask questions later.