GoKawiilCritical PHP vulnerabilities force websites offline, NSA urges shutdown until patched
Security researchers and AI models independently discovered two critical vulnerabilities in PHP, the scripting language used by roughly 70% of websites, in mid-August. The flaws can let attackers directly access a site's underlying file system or database, and Amazon Web Services says they are already being widely exploited. The NSA has advised organizations to take unpatched PHP-based sites offline until they can apply fixes, prompting many commercial and government sites to go dark this week.
GoKawiil's interpretation of the reporting above, not reported fact.
The scale of PHP's use means even a narrow exploit chain could expose personal data across a huge share of the web, making this a rare case where officials recommend taking infrastructure offline rather than risk exploitation. The early leak of the vulnerability details, ahead of the planned disclosure embargo, may have given attackers extra time to act before site owners could patch, according to the reporting. Government involvement via NSA guidance suggests the issue is viewed as a broad national security concern rather than a routine bug.
- Two critical PHP vulnerabilities, found by researchers and AI models in mid-August, can expose servers' files and databases.
- AWS reports the flaws are already being actively exploited across the internet.
- The NSA has recommended taking unpatched PHP sites offline until fixes are applied, leading many sites to shut down temporarily.
Source: 9to5mac.com — Ben Lovejoy, 2026-10-22
Published there as: “What’s going on with the web? The PHP issue and sites going offline”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.