AI found a hole in half the internet. The FBI said unplug. Who makes the call?

In 2003 I hosted an event called The Blogging Enterprise. One of the speakers was Matt Mullenweg, a very young, very smart guy from Houston who had just started a project called WordPress. WordPress, like Drupal, was built on a programming language called PHP. Today PHP runs about 70% of websites whose underlying language is known.

On October 21, PHP's maintainers released an emergency fix for PHP2Shell, a vulnerability that let an outsider take control of a website's server without logging in. It had sat inside PHP for more than a decade. Researchers at Calif, OpenAI and Wiz used AI to find it. Details leaked a day before the fix was due out, and Cloudflare saw attacks before it shipped. The FBI and NSA told organizations to take their systems offline if they could not update right away.

That advice turned a software update into an executive decision for thousands of organizations on the same afternoon: update tonight, or switch the website off.

I ran the scenario through CrisisCommand®, and the platform pulled three cases that sit at different points on that decision. In each one, the fix mattered less than who decided what to do about it, and when.

Moodle and Saylor University decided to go dark

Moodle, the online classroom software many schools run on, began taking sites offline on the afternoon of October 21, following guidance from European and Australian cyber agencies. Saylor University told students its courses would be offline until 10 a.m. while its Moodle partners installed the update. By the next evening, Moodle said every client site it hosts was patched and back online, with no evidence of exploitation. The cost was one night of lost class time. For Saylor, the vendor made the technical call and the university owned the message to students.

Equifax had a fix and no one acted on it

In 2017, attackers broke into Equifax through a known hole in the software behind its website. A fix had been available for months, and Equifax had not installed it. The breach exposed personal data, including Social Security numbers, for roughly 147 million people. Equifax paid at least $700 million in a settlement with federal regulators and 50 states, and its CEO, CIO and chief security officer left the company.

Oracle's customers had no fix to install

In 2025, the Cl0p extortion group exploited a flaw in Oracle E-Business Suite, the software many large institutions use for HR, finance and purchasing. Investigators traced data theft back to at least August. Oracle shipped an emergency fix on October 4. Cl0p then emailed executives with ransom demands and began naming victims, including Harvard, the University of Pennsylvania and Dartmouth. For those institutions, the patch-or-wait question never came up. Attackers moved first, and the only decisions left were about containment and disclosure.

The decision is the exposure

The technology failed differently in each case. What separated the outcomes was whether someone already had the authority to act. Moodle had a trigger set in advance: follow the cyber agencies' guidance and take sites down. Equifax had a fix and no owner for installing it. Oracle's customers had neither a fix nor time, so the only decision left was what to tell people.

The PHP2Shell window lasted hours, not weeks. An admissions portal, a patient login or an online store that goes dark at 4 p.m. on a weekday needs three things settled before anyone reads the advisory: who is allowed to turn it off, what stays up, and what the people locked out hear in the first hour. If those get argued out in the moment, the advisory sets the clock and the organization spends it in meetings.

How the call breaks down

The sequence repeats. A flaw is disclosed. A government agency or a vendor issues guidance. The hosting provider, if there is one, acts on its own schedule. Then the institution finds out whether its leadership, its IT team or its vendor holds the switch. For many schools on hosted Moodle, the vendor made the call before the school did. AI tools are now finding old flaws like this one, and this disclosure still leaked a day early.

What works

Name who is allowed to switch it off. Write down the person allowed to take public systems offline, plus a backup, and cover nights and weekends.

Decide what stays up. Agree in advance which systems go dark first and which keep running, such as payments, patient records or financial aid.

Write the outage notice now. Draft the message for students, patients or customers: what is down, why, and when it comes back.

Ask your vendors what they will do without you. Find out whether each hosting provider will take your site down on its own, and how it will tell you.

Speak up even when you are not affected. Trust Wallet, which does not run on PHP, posted a note telling customers no action was needed.

What does not work

Leaving the call to whoever is online. The decision falls to a junior engineer or waits for a meeting while the attack window is open.

Treating an available fix as a decision. Equifax had the fix for months. Nobody owned installing it.

Waiting until everything is patched to say anything. Students and customers notice the outage first, and silence fills with guesses.

Assuming your vendor will warn you first. A provider acting on its own schedule leaves you explaining an outage you did not choose.

---

Matt built WordPress in 2003 so anyone could put a site online. Twenty-three years later, Moodle switched off and was back within a day, Equifax paid $700 million for a fix it never installed, and Oracle's customers heard about their breach from a ransom email. Decide now who is allowed to switch your public systems off. Then write the notice before you need it.

Commentary on public reporting. CrisisCommand does not represent the organizations named. CrisisCommand is decision support: it augments professional judgment and never replaces it, and all decisions remain with the organization.