“Web services are supposed to run continuously, 24 hours a day, 365 days a year.” When did we start taking this for granted?
High availability certainly has value. Many systems must be available whenever they are needed, including online payments, healthcare, transportation, emergency communications, and services used by people around the world. Providing a stable service is a commitment to customers and an important foundation of business trust.
However, improving availability and believing that a system must never stop, even for a moment, are not the same thing.
In October 2026, several PHP vulnerabilities were disclosed (which was called as “PHP2shell"), and users were urged to update to fixed versions. For affected configurations, the vulnerabilities could potentially allow unauthenticated parties to execute code, prompting warnings from the PHP project and a public cybersecurity organization. Serious vulnerabilities like these force organizations that use software to ask whether they are prepared to identify what is affected, decide how to respond, and apply updates safely.
This does not mean that “being always on” caused the vulnerabilities. The question is whether an organization can carry out necessary actions promptly and safely when a risk becomes known.
The theme of this series is whether the value gained from 24/365 uptime is worth the security risk. Rather than rejecting continuous operation outright, we will examine its benefits and trade-offs from the perspectives of security, operations, and business.
References