We've adopted a zero-risk posture at our org. We've taken down numerous amounts of services over the last few weeks related to PHP, Node, and Python until things are properly vetted.

We joked in our last internal meeting that this is the end of public software... I have a feeling we may be right, at least in the very short term.

That's what Meltdown, Spectre, Rowhammer, and other hardware bugs have been. While you can't patch the hardware, there have always been software level mitigations.

Thankfully a lot of the low level stuff is just not that exposed to the network so even if you find a bug in some firmware, you still have to find a way to access it over the network.