[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-nsa-urges-sites-to-weigh-going-offline-over-two-php-flaws":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12030,"nsa-urges-sites-to-weigh-going-offline-over-two-php-flaws","NSA Urges Sites to Weigh Going Offline Over Two PHP Flaws","Two severe PHP flaws allow remote code execution without a login, and the NSA says websites should consider going offline.","Websites and servers running PHP face two severe vulnerabilities, and the NSA said operators should consider taking sites offline.\n\nBoth flaws can lead to unauthenticated remote code execution. In plain terms, an attacker needs no account or password to run their own commands on a vulnerable machine from afar. That gives hackers a way to tamper with websites and with the servers underneath them.\n\nPHP is a scripting language that runs on the server and builds web pages before they reach your browser. It sits behind a large share of the web, including WordPress sites. Pulling a site offline costs it visitors and revenue by definition, so the NSA putting that option on the table is notable on its face.\n\nFor scale, consider Log4Shell, the December 2021 flaw in a widely used Java logging library. It also allowed remote code execution, and it sent organizations scrambling to find where the library was buried in their systems. That is context, not a claim that the PHP bugs match it.\n\nThe practical question for many site owners is simpler than it sounds: do they know where PHP runs in their stack? It often sits beneath a content management system or a hosting plan they never configured themselves.","[\"php\",\"vulnerability\",\"nsa\",\"remote-code-execution\"]","2026-10-21T14:35:46.000Z","2026-10-21T15:13:02.232Z","2026-10-21T15:13:02.694Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Delete the sentence saying the advisory summary doesn't name affected PHP versions or explain how the bugs work, because it exposes the source's limits instead of reading as finished copy; also cut or clearly label as context the unsupported claims that the offline advice is 'reserved for flaws that are easy to reach and costly to exploit' and that the Log4Shell comparison is 'fair', and add concrete specifics (CVE IDs, affected versions, patch status) only if they can be verified.","resolved","security",[32,33,34,35],"php","vulnerability","nsa","remote-code-execution",[37],{"name":38,"url":39},"PCMag","https:\u002F\u002Fwww.pcmag.com\u002Fnews\u002Fphp-flaw-is-so-serious-websites-should-consider-going-offline-nsa-says",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7053,"2026-10-21T17:05:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1031,"2026-10-21T16:20:08.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",560,"2026-10-21T13:46:18.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",550,"2026-10-21T15:41:35.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",282,"2026-10-21T15:51:59.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",267,"2026-10-21T17:57:33.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",211,"2026-10-21T09:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",138,"2026-10-21T14:03:11.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",136,"2026-10-21T15:00:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",93,"2026-10-21T15:50:41.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",84,"2026-10-21T02:56:30.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]