levelsio took all his sites offline to wait out a PHP patch
He told anyone running PHP to do the same, and said Ubuntu's backported fix arrived fast.
levelsio says he pre-emptively disconnected all his sites and VPS servers from the web ahead of a PHP patch due to land at 2 PM UTC. His advice to everyone else was blunt. If you have a PHP website, take it down until you patch PHP.
If you have a PHP website, probably good to take them down until you patch PHP
His reasoning was scale. He put the share of the web running on PHP at 69.3% and said this was going to be intense. The cost of the move, in his telling, was an annoying holding screen on every property he runs for a few hours.
The wait was short. A few hours later he posted that everything was back up, crediting Ubuntu for publishing the backported PHP fix very fast and thanking the Ubuntu and PHP Foundation teams.
He does not think this kills PHP
Some people told him this would be the end of PHP. He disagrees, and his reason is the part worth sitting with. He argues that AI-assisted vulnerability exploits will increasingly hit any language, any framework and any server software, and points out that Node patched a high security vulnerability the same week. He frames what comes next as an endless cat and mouse game between attackers using AI to probe every app, site and server, and companies using AI to defend.
That is one founder's read, not a measured trend, and he is not claiming to have been exploited. What he actually did is the useful bit. He treated scheduled downtime as a cheap insurance premium rather than a failure, and he made the call before the patch existed rather than after an incident.
The business read
If you run a one-person software business, your attack surface is usually a single unattended VPS that nobody is watching on a Saturday. You do not have a security team, you do not have a pager rotation, and you probably do not read CVE announcements. levelsio does not either, as far as the posts show. He just took the whole thing off the internet and waited.
This fits the pattern he has been working through publicly. He has already posted a VPS lockdown setup built on Cloudflare Tunnel, Tailscale and an empty firewall, and he spent a day running security audits through Claude Code. Pulling the plug for an afternoon is the crudest tool in that kit, and on this occasion it was the one he reached for first.
A new era of cybersecurity has begun
Steal the numbers, not the vibes
One email a day. Under three minutes. Real MRR, real pricing, real launches from founders building with AI.