Which kind of makes sense, I think a lot of Dutch websites have been taken offline. I think it’s due to recent regulations that have been introduced.
I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.
That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?
Tons of sites are currently offline to hopefully prevent an attack until they can update PHP; just the things I've run into this morning: OBS, TicketTailor, tons of wikis...
Not all hacks are used to steal data. It's an authoritative website. If this hack is used to host a fake PHP fix stuffed with credential stealers then you have a problem.
Oh I absolutely agree they should take it offline until the fix is ready, I just mean that the NCSC itself is very much still operational even if their public website is temporarily offline. Like a computer with the monitor switched off.
PHP is going to publish the patch in 5 minutes, right? On their website which runs on... Perl Catalyst? Ruby on Rails? Django? What could possibly go wrong?
I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.
That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?
https://yle.fi/a/74-20252600