Engineering Patching is now a business decision: lessons from React2Shell React2Shell was under attack about a day after disclosure. What it and 2026's Next.js advisories teach business owners about patching.