A significant number of websites have gone offline, and that’s not due to a service outage, but rather a deliberate decision by the site’s owners.
The reason is because extremely dangerous security vulnerabilities have been found in a protocol used by most websites – PHP. This issue is unrelated to the separate vulnerability discovered in web certificates …
What is PHP?
PHP is one of the weirder acronyms around. While it originally stood for Personal Home Page, it’s now more usually defined as the recursive “PHP: Hypertext Preprocessor.”
PHP is an open-source, general-purpose scripting language, very well suited to web development and able to be embedded into HTML. It’s used by around 70% of all websites.
What happened?
AI models and a cybersecurity researcher simultaneously discovered a major security flaw in PHP in mid-August. A combination of two vulnerabilities allowed an exploit which could give an attacker direct access to the underlying file system or database behind a website. That could expose a vast amount of personal data.
To allow time for the problem to be patched by the PHP Foundation, disclosure of the vulnerabilities was embargoed until this week (though it leaked two days ahead of the embargo). However, not every website has been able to apply the patch as yet, and Amazon Web Services said that the vulnerabilities are being “broadly exploited” across the internet.
The problem is so serious that the NSA has advised that unpatched sites be taken offline until the problem is fixed.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
— NSA Cyber (@NSACyber) October 21, 2026
For that reason, a great many commercial and government websites have been taken offline until PHP can be updated on their servers.
I’m happy to be able to confirm that 9to5Mac and its sister sites are already protected.
- iPhone Duo cases
- Beats Woven USB-C cables
- Certified refurbished Apple products 15% off at apple.com
- Discounted AirPods Pro 3
- Wireless CarPlay adapter
- 10-year AirTag battery case
- Logitech MX Master 4 for Mac
FTC: We use income earning auto affiliate links. More.