For me (I host a lot of PHP...):
1. First I hear about it is a heads-up at 5:00 am 21st.
2. Available info then is pretty much, "omg, it's the end of the internet".
3. There are no specifics available on exploitable configurations.
4. Updates are not expected to be available for at least two more hours, so people start deciding to do the Madagascar "shut down everything" meme.
5. Cloudflare says they're seeing exploits in the wild, well, that's not great.
6. I shut down everything, including a national brand, because wtf else am I supposed to do at this point?
7. Updates become available at 0645. Fortunately, I don't run my entire infra on Docker, so I'm immediately deploying the updates to all configurations and bringing sites back online approximately in order of traffic volume.
8. Still no specifics on the exploit.
9. A million vibe-coded PoCs appear on GitHub ... and none of them work.
10. It's late morning local time on the 21st and I'm still bringing things back online, having taken the day off from my regular job.
11. Conversation starts to shift towards, "...oh, did we over-react? How exploitable is this exactly?"
12. Still no specifics available.
13. Somebody on the internet gets as fed up as I am with the whole chaos vortex of idiocy and stands up a site saying, "okay, here's some money if you can exploit it."
14. Hours pass.
15. Still no specifics available.
16. Zeitgeist becomes, "I guess it's not exploitable after all."
17. The test site gets 'sploited.
18. Finally somebody actually posts the damn specifics -- namely, the person that grabbed the $2k.
19. Late morning local time on the 26th, and the conversation becomes, "well, obviously this was exploitable!" <-- we are here
Coincidentally, I just started reading Crisis Engineering, which seems like an excellent and applicable book, but I'm not sure who to beat with it.
1. First I hear about it is a heads-up at 5:00 am 21st.
2. Available info then is pretty much, "omg, it's the end of the internet".
3. There are no specifics available on exploitable configurations.
4. Updates are not expected to be available for at least two more hours, so people start deciding to do the Madagascar "shut down everything" meme.
5. Cloudflare says they're seeing exploits in the wild, well, that's not great.
6. I shut down everything, including a national brand, because wtf else am I supposed to do at this point?
7. Updates become available at 0645. Fortunately, I don't run my entire infra on Docker, so I'm immediately deploying the updates to all configurations and bringing sites back online approximately in order of traffic volume.
8. Still no specifics on the exploit.
9. A million vibe-coded PoCs appear on GitHub ... and none of them work.
10. It's late morning local time on the 21st and I'm still bringing things back online, having taken the day off from my regular job.
11. Conversation starts to shift towards, "...oh, did we over-react? How exploitable is this exactly?"
12. Still no specifics available.
13. Somebody on the internet gets as fed up as I am with the whole chaos vortex of idiocy and stands up a site saying, "okay, here's some money if you can exploit it."
14. Hours pass.
15. Still no specifics available.
16. Zeitgeist becomes, "I guess it's not exploitable after all."
17. The test site gets 'sploited.
18. Finally somebody actually posts the damn specifics -- namely, the person that grabbed the $2k.
19. Late morning local time on the 26th, and the conversation becomes, "well, obviously this was exploitable!" <-- we are here
Coincidentally, I just started reading Crisis Engineering, which seems like an excellent and applicable book, but I'm not sure who to beat with it.