When the PHP2Shell vulnerabilities became public, my thoughts went back to Log4Shell. Five years ago, Log4Shell showed how difficult it can be to respond to a critical vulnerability in software used across countless applications and services. PHP2Shell presents a similar challenge.