NSA says take PHP systems offline if unpatchable; some Cisco fixes not due until Feb 2027
shashib · x · 2026-10-24
The NSA's fallback for two critical PHP runtime flaws (CVSS v4.0 9.2) is to take systems offline until fully mitigated — a hard call given PHP powers roughly 70% of websites with a known server-side language.
Key facts:
- The flaws live in the PHP runtime itself, so updating plugins or application code does nothing; the engine underneath must be replaced
- The hardest cases are vendor-embedded PHP in appliances and hosting control panels, where the fix date belongs to the vendor
- First exploitation attempt came four days before disclosure (Oct 17, per Amazon)
- Cisco still has 13 products under investigation; its Ultra-Reliable Wireless Backhaul fix isn't due until Feb 2027
The author notes common blind spots: plugins marketing teams installed years ago and appliances that list a web interface but not the language beneath — inventories built from public DNS records will miss them.
More from Infra
- OpenRouter slide shows token usage exploding as blended cost per token keeps falling — aniketmaurya · 2026-10-24
- Jack Dorsey touts full-duplex realtime voice model trained on a single GB200 NVL72 — TinfoilTricorn · 2026-10-24
- Level1Techs Video: How to Get Quality Results From Your Local AI Setup — Thrumpwart · 2026-10-24
- OpenAI and Anthropic Are Just 'GPU Wrappers' With No Physical Moat, Argues Viral Post — Frosty_Toast_Man · 2026-10-24
- 5 'OpenAI-Compatible' API Lies We Hit Building an AI Gateway — respan-81 · 2026-10-24
- If It Flies, Floats or Finetunes, Renting Is Cheaper — yaroslavvb · 2026-10-24