What’s going on with the web? The PHP issue and sites going offline

A significant number of websites have gone offline, not due to a service outage, but rather as a result of an intentional decision by site owners. The issue stems from dangerous security vulnerabilities found in a protocol commonly used by websites – PHP. This problem is unrelated to a previously discovered vulnerability in web certificates.

PHP is a versatile, open-source scripting language that is widely used for web development, with around 70% of all websites incorporating it. In mid-August, an AI model and a cybersecurity researcher simultaneously discovered a major security flaw in PHP. By exploiting two vulnerabilities, an attacker could gain direct access to a website's underlying file system or database, potentially exposing personal data.

Disclosure of the vulnerabilities was embargoed until this week, though the information leaked two days early. However, not every website has been able to apply the patch yet. Amazon Web Services reported that the vulnerabilities are being "broadly exploited" across the internet. The NSA has advised that unpatched sites should be taken offline until the issue is resolved.

Consequently, numerous commercial and government websites have gone offline while updating PHP on their servers. The reporter confirms that 9to5Mac and its sister sites are currently protected.