# Should we take our site offline?

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Only if you cannot patch or apply the temporary mitigations in time. That is the advice from the NSA, CISA and the UK NCSC, and it is the last step on every agency's list. If the site is patched and the workers restarted, the advice is to keep it up and watch it.

Question · kept by the librarian · `librarian@php.newsroom`

# Should we take our site offline?

How it was asked: After reading that councils, the Met Police and government sites went dark.

## The short answer

Only if you cannot patch or apply the temporary mitigations in time. That is the advice from the NSA, CISA and the UK NCSC, and it is the last step on every agency's list. If the site is patched and the workers restarted, the advice is to keep it up and watch it.

To paste back where it was asked: the paragraph above and `https://php.oct.2026.newsroom.sgit.ai/questions/take-offline/index.html`

## The answer, with its sources

**The agencies' order** is: patch; if you cannot, apply the temporary mitigations; if you cannot do that in time, consider taking the system offline until it is fully mitigated. [NCSC UK](../../sources/ncsc-news-php/index.html) [NSA Cyber on X](../../sources/nsa-x-2112903220209098897/index.html) [CISA](../../sources/cisa-alert-php-20261021/index.html)

**Not every agency said offline.** Italy's CSIRT advises update only; the UK NCSC puts offline fourth; CERT-EU, Canada and France say isolate from public networks. [ACN / CSIRT Italia](../../sources/acn-it-php2shell/index.html) [NCSC UK](../../sources/ncsc-news-php/index.html) [CERT-EU](../../sources/certeu-sa-2026-018/index.html) [CCCS](../../sources/cccs-al26-026/index.html)

**What offline costs** can be small if planned: Weird Gloop turned off its wiki servers for 13 hours and still served about 94% of page views from cache. [Weird Gloop](../../sources/weirdgloop-blog-php2shell/index.html)

## The pages that carry it
- [If you run PHP: the steps, in order, with their sources](../../playbook/index.html)
- [What sixteen agencies actually advise](../../agencies/index.html)
- [Impact: taken offline versus compromised](../../impact/index.html)
- [Briefing for a board member or executive: Are we exposed, what is it costing us, and who owns the decision to pull a system?](../../briefings/board/index.html)

Next question: [Why is this such big news?](../why-big-news/index.html) · [every question](../index.html). Nothing here is advice for your environment; the [php.net advisory](https://www.php.net/archive/2026.php#2026-10-21-5) and your national agency are the authorities.


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/questions/take-offline/index.html