The NSA just told the entire internet to patch or go dark.
Effective immediately.
Not "please consider updating."
Not "we recommend patching at your earliest convenience."
Patch or unplug.
Those are the options.
The NSA doesn't issue advisories for every vulnerability.
They issue them when something is bad enough that the spy agency whose entire job is breaking into systems is worried about other people breaking into systems.
PHP powers 43 percent of the web.
The NSA just told 43 percent of the web to stop existing until it gets fixed.
Or patch in the next 24 hours and hope the attackers haven't already gotten in.
Most organizations are picking option three.
Taking it offline.
Safer to be unavailable than compromised.
The Dutch Parliament already did it.
Finland's government already did it.
University of Vienna already did it.
Now the NSA makes it official.
"If an immediate update is not feasible it is recommend that organizations take the system offline until it can be fully mitigated."
Translation: you can't patch fast enough so just shut it down.
Patch takes 30 minutes.
Testing takes hours.
Deployment takes longer.
Meanwhile attackers are already inside.
So the NSA's advice is logical.
If you can't patch in 30 minutes go offline now.
Don't wait for the attacks.
Don't test first.
Don't coordinate with stakeholders.
Just unplug it.
The NSA will follow up with more specific guidance.
Which is intelligence agency speak for we're watching the attack traffic and we'll tell you what else they're doing with the access they already have.
Time to bump one of my favorite videos
October 15th, 2022 - A watch party for Tennessee vs Alabama hears the roar of Neyland after the game winning kick by Tennessee, and then sees it on TV after the 20 second delay
@KingTheoVol made it to the transplant list. That being said, the family as exhausted all resources to get to this point, and now the most crucial period takes place.
https://t.co/g7RCXDTiz1
It's not every day we get a chance to say we helped save a life. The Go fund me is at $16k, but that doesn't touch what is coming. If you all can help by sharing or giving, please do. The young man deserves it.
Remember when Alabama WR Jermaine Burton punched a female Tennessee fan he faced *zero* consequences for it.
Not Nick Saban, nor the SEC, nor the NCAA did a damn thing about it.
You don’t hate Alabama enough.