Websites and servers running PHP face two severe vulnerabilities, and the NSA said operators should consider taking sites offline.
Both flaws can lead to unauthenticated remote code execution. In plain terms, an attacker needs no account or password to run their own commands on a vulnerable machine from afar. That gives hackers a way to tamper with websites and with the servers underneath them.
PHP is a scripting language that runs on the server and builds web pages before they reach your browser. It sits behind a large share of the web, including WordPress sites. Pulling a site offline costs it visitors and revenue by definition, so the NSA putting that option on the table is notable on its face.
For scale, consider Log4Shell, the December 2021 flaw in a widely used Java logging library. It also allowed remote code execution, and it sent organizations scrambling to find where the library was buried in their systems. That is context, not a claim that the PHP bugs match it.
The practical question for many site owners is simpler than it sounds: do they know where PHP runs in their stack? It often sits beneath a content management system or a hosting plan they never configured themselves.