Silly journalist. The flaw is of course not in the PHP language, but in its runtime environment
Does this affect Facebook’s ‘not PHP’?
Could someone please explain in what situation would any website need to go offline to update PHP?
I’m sure a lot of websites are using older unsupported versions of PHP that have no update
Taking a website permanently might be the fix for a lot of people
Normally updates like this are patched quietly, and sometimes without disclosing what exactly the exploit is
This one was leaked early and tutorials supposedly popped up on Twitter, all before the patches were released to relevant software
On top of that, it was a pretty bad exploit (RCE)
So websites were taken offline because either
- they needed to wait for someone with experience to confirm it was patched and safe
- they needed to wait for an update to be sent their way
It’s hard to tell how many of the tutorials are real. As soon as people knew there was a problem, they were asking LLMs what the problem was and how to exploit it, and the LLMs of course make stuff up.
The US National Security Agency told all organisations using PHP to take their systems offline if they were unable to patch them immediately.
It can take awhile to patch every system in the world that uses PHP at the same time, so until then it’s better to just turn the server off until you can.
There’s a vulnerability in php that allows malicious actors to execute code on your server. Everyone is advised to take their php website down until the moment they have implemented php’s security patch. If they leave the vulnerable site up, consequences could be severe, all user data could be stolen.
