If you have noticed an unusual number of websites going dark in recent days, the cause is not a typical service outage. In many cases, the people running those sites have taken them down on purpose, responding to what security experts describe as extremely dangerous vulnerabilities in PHP, a technology that underpins most of the internet.
PHP is something of an oddity among acronyms. It originally stood for Personal Home Page, but these days it is usually defined recursively as PHP: Hypertext Preprocessor. Whatever the name, it is an open-source, general-purpose scripting language that is particularly well suited to web development and can be embedded directly into HTML. Its reach is enormous: around 70 percent of all websites rely on it.
The trouble began in mid-August, when AI models and a cybersecurity researcher independently and simultaneously identified a major security flaw in PHP. On their own, each issue might have been manageable. Combined, two vulnerabilities created an exploit that could allow an attacker to reach the underlying file system or database sitting behind a website, potentially exposing a vast amount of personal data.
To give the PHP Foundation time to develop and distribute a fix, details of the vulnerabilities were placed under a disclosure embargo that was due to lift this week. That plan did not hold perfectly: information about the flaws leaked two days ahead of schedule, raising the pressure on site operators everywhere.
The patch now exists, but not every website has been able to apply it yet. That gap between disclosure and deployment is where the danger lies, and it appears to be actively abused. Amazon Web Services has said the vulnerabilities are being "broadly exploited" across the internet.
The situation is considered serious enough that the National Security Agency has weighed in, advising that sites which have not yet been patched should be taken offline until the problem is fixed. For organizations handling sensitive information, keeping a vulnerable server running is judged a bigger risk than going dark temporarily.
That guidance helps explain the wave of outages. A great many commercial and government websites have been deliberately taken offline and will remain unavailable until PHP can be updated on their servers. What looks like a widespread technical failure is, in large part, a coordinated act of caution.
The PHP issue is also separate from another security story making the rounds. A distinct vulnerability recently discovered in web certificates is unrelated to this one, even though the two have surfaced at roughly the same time.
For its part, 9to5Mac, which first reported on the situation, has confirmed that it and its sister sites are already protected. For everyone else, the advice is straightforward: patch PHP as quickly as possible, and until then, a site that is offline may simply be a site being kept safe.
