Why Our Websites Were Offline Today

If you tried to reach AgentTech, or one of the other public websites we operate, and found a maintenance page, that was us. We took those sites offline this morning, and we brought them back this afternoon after a security patch was installed. I want to explain that in ordinary language. You trusted us with your information, and that trust is the reason we made the call.

What happened

Early today, the people who maintain PHP issued an emergency warning. PHP is a piece of software that builds a large share of the websites on the internet, including ours. You never see it. It is the machinery behind the page.

The warning described a serious flaw. In plain terms, someone on the internet could have used it to run commands on a server that had not been fixed yet. When the warning arrived, the fix did not exist. There was no switch we could flip that would close the hole and leave the sites up. The official patch came later in the day. Until we installed it, a site still running that software was exposed.

Why we could not wait

Our websites are the front door to information people expect us to protect. Names, phone numbers, and the details of insurance inquiries are not the kind of data you leave sitting behind a known, unpatched hole while you hope for the best.

Hoping is no longer a serious plan. Once a flaw like this is public, the people who attack websites do not spend the afternoon reading about it. Automated tools, including AI agents, start trying it against every server they can find, often within minutes of the warning. That is the world we operate in now. The time between "this is public" and "someone is trying it" has collapsed.

CISA and the NSA told organizations to take systems offline if they might be vulnerable. A working proof of concept was already public before the patches existed. Cybersecurity firms published the same advice. We followed it.

So we turned the sites off. Visitors saw a simple holding page. That page is a plain file. It does not run PHP, so the flaw had nothing to attach to. We installed the patch, confirmed the sites were serving normally, and brought them back this afternoon.

How unusual this was

I want to be direct about how out of the blue this was. Updates to the software behind a website are routine. We apply them without taking the sites away from you. Today was different, and nobody had it on the calendar: a critical flaw, announced before a patch existed, with no safe way to stay online while we waited.

Security flaws are scored from 0 to 10. PHP rated this one 9.2, which is Critical, the top band on that scale. An early unofficial report called it a perfect 10, and PHP corrected the number. I have been building software for sixteen years. This is the worst flaw we have seen in PHP in a long, long time, and it sits about as close to the top of that scale as this language gets.

The reach is what made today rare. This flaw was not limited to one form or one page on our site. It was in PHP itself, the layer under the page, and a stranger did not need a password to attempt it. Versions of that software going back many years were affected. PHP runs a large share of the world's websites, and organizations much larger than ours took public sites offline this morning for the same reason. Most security fixes can be applied in the background. This one could not. We took the sites down because of the warning itself. Waiting to see whether someone used the flaw would have been the wrong risk.

What we are changing

Today also showed us a gap in how fast we can get your data out of reach. We now have a single switch that puts every public site on a static holding page, the page you may have seen, which does not run the affected software. That used to be a scramble. It is now a step we can take immediately.

We are going further, so a day like this does not have to mean the same outage next time. We will put additional security tooling in front of these sites, so known attack traffic can be stopped before it reaches the software underneath. That is how we intend to stay online through the next event of this kind, and to apply a vendor patch the hour it is published. The holding page stays in place as the fallback when a flaw is public and those defenses cannot yet cover it. This morning, that option was not ready. Taking the sites offline was.

The decision

I am sorry for the interruption. If a form, a page, or a conversation you needed today had to wait, that cost you time, and I know it.

It was still the right decision on your behalf. A few hours of inconvenience is not worth more than the information you have given us. The sites are back. The patch is in place. If a warning like this ever shows up again, we will stop first and explain after, the same way we are doing here.

Thank you for your patience today.

Dustin Snider
CEO