10/22/2026
If you bank at MSUFCU, Wednesday was a little alarming. Website down. App down. Online banking down.
Your card still worked, though. So did everyone's.
That's not luck. That's the whole story.
It wasn't a hack. A flaw turned up in PHP — the software behind most of the websites on the internet, including every WordPress site — that let a stranger run their own code on a web server without a password. Rated 9.2 out of 10.
And here's the part that made Wednesday weird: there was no workaround. No setting to switch off. PHP said so themselves. Patch it, or turn it off.
So a lot of people turned it off. Government websites in six countries. Mizuho Bank. Japan Airlines. Hospitals and schools across Europe. And a credit union in East Lansing.
MSUFCU lost a day of online banking and kept your card working the whole time, because card processing at a credit union that size doesn't run through the website. Different system. They got to choose which part went dark.
That's the question I'd actually ask about your business.
If your website had to go off for 24 hours — would your booking form still work? Your quote requests? The number customers tap to call you? Or does all of it live in the one place, so the site goes down and you just… go dark?
And the cheaper question: would you even know your site was down right now? Most owners find out from a customer. Which means they find out late.
I wrote up what actually happened — the real timeline, why millions of attack attempts have produced no confirmed break-in yet, and the strange detail that this 14-year-old bug was finally found using AI.
A PHP flaw became unauthenticated remote code ex*****on with no workaround, so banks and governments went dark on purpose. What happened in Lansing, and why.