Dutch National Cyber Security Center is Offline because it uses PHP

WJW

Well, the public website of the NCSC is offline. Who knows what crazy proprietary stuff they have.

Hamuko

Finnish state services too. https://yle.fi/a/74-20252600

tosti

PHP is going to publish the patch in 5 minutes, right? On their website which runs on... Perl Catalyst? Ruby on Rails? Django? What could possibly go wrong?

geerlingguy

Tons of sites are currently offline to hopefully prevent an attack until they can update PHP; just the things I've run into this morning: OBS, TicketTailor, tons of wikis...

stingraycharles

Which kind of makes sense, I think a lot of Dutch websites have been taken offline. I think it’s due to recent regulations that have been introduced. I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well. That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?

mkesper

That's why (mostly) static sites should be delivered as static HTML.

louwrentius

It's easy to harp on PHP but I wonder if we're going to get this kind of vulnerabilities in languages like Python or Go soon too.

sam_lowry_

Also the Belgian Centre for Cybersecurity is down https://ccb.belgium.be/ Dark day for Drupal and Wordpress, heh

freecodeio

my thoughts and prayers to the stubborn php 4-6 developers who refused to upgrade since 7 and now they have breaking changes with the new 9.2

2OEH8eoCRo0

All my favorite private trackers such as empornium are down :(

dmitrijbelikov

Never enough blame PHP/s

phplovesong

PHP strikes again.

rasz

so is Australian one https://www.cyber.gov.au . It was still working ~hour ago just returning 403 on alerts subsection https://www.cyber.gov.au/alert/critical-vulnerabilities-in-p... but now its whole thing.

gaiagraphia

>The National Cyber Security Center (NCSC) >Safely ahead in a digitally resilient Netherlands. Things being offline seems like a daily occurrence recently. Is it a co-incidence? Is it AI? Are Russia/Iran doing an e-blitzkrieg? If it's a combination of all three, surely nation states are going to unleash everything possible right now and do as much damage before the world adapts and becomes resilient? If the latter, would be interesting to put an actual cost on all this downtime and whether it's actually making any impact, or is just noise/free training.

amosj

Also explainxkcd: https://www.explainxkcd.com/wiki/index.php/Main_Page > Today, a remote code execution vulnerability was found in PHP, called php2shell. [...] Since explain xkcd is affected by this exploit, I have decided to take the wiki down until tomorrow.

HelloUsername

Maybe change URL to https://web.archive.org/web/20261021115632/https://www.ncsc.... ?

aequitas

Lots of obsolete PHP still being used by the Dutch government: https://basisbeveiliging.nl/museum/NL/

ltbarcly3

Now you will get a taste of life in the new world order, one without Pax Bitterballen.

genxy

Lol, coding themselves a minivan. This is like a demining company planting mines in the front lawn.