NSA Urges Website Shutdowns Over Critical PHP Flaws

The National Security Agency issued an advisory on October 21 urging organizations to take websites offline if they could not immediately patch critical flaws in PHP. The vulnerabilities allowed unauthorized users to execute server commands without passwords, posing a systemic risk to the programming language that powers most global websites.

In response to the threat, governments in Germany, France, Belgium, the Netherlands, Finland, and the Czech Republic temporarily disabled several government sites. The Prime Minister of Japan also issued a public notice on X.com directing the country to patch its systems.

OpenAI and security researchers discovered the flaws using AI models in August and spent two months collaborating with PHP maintainers to develop a fix. Despite this coordinated effort, Amazon detected exploit attempts four days before the public release. Following the disclosure, attackers successfully breached systems in the United States, Japan, Taiwan, and South Korea.