Kareem Badr

The NSA just told the entire internet to patch or go dark. Effective immediately. Not "please consider updating." Not "we recommend patching at your earliest convenience." Patch or unplug. Those are the options. The NSA doesn't issue advisories for every vulnerability. They issue them when something is bad enough that the spy agency whose entire job is breaking into systems is worried about other people breaking into systems. PHP powers 43 percent of the web. The NSA just told 43 percent of the web to stop existing until it gets fixed. Or patch in the next 24 hours and hope the attackers haven't already gotten in. Most organizations are picking option three. Taking it offline. Safer to be unavailable than compromised. The Dutch Parliament already did it. Finland's government already did it. University of Vienna already did it. Now the NSA makes it official. "If an immediate update is not feasible it is recommend that organizations take the system offline until it can be fully mitigated." Translation: you can't patch fast enough so just shut it down. Patch takes 30 minutes. Testing takes hours. Deployment takes longer. Meanwhile attackers are already inside. So the NSA's advice is logical. If you can't patch in 30 minutes go offline now. Don't wait for the attacks. Don't test first. Don't coordinate with stakeholders. Just unplug it. The NSA will follow up with more specific guidance. Which is intelligence agency speak for we're watching the attack traffic and we'll tell you what else they're doing with the access they already have.