Party
National agencies (NSA, CISA, NCSC UK, CERT-EU, CERT-FR, CCCS, ACSC, NCSC NZ, NCSC-NL, ACN, BACS, CERT.LV, JPCERT)
advisories; see the agency table
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| All PHP versions from 5 onwards are affected by at least one of the flaws The CVE records list only 8.2 to 8.5 with defaultStatus 'unaffected'. php.net published source backports for 7.4, 8.0 and 8.1, which implies they are affected. A scanner that trusts the CVE record will miss 7.4 to 8.1. | NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1) | disputed | 3/4 | NCSC-NL Wiz on X CERT-FR oss-security |
| A web application firewall may provide some protection until systems are patched Swiss BACS: 'Even a web application firewall alone is not sufficient.' Cloudflare says its rules blocked the traffic it saw and that attackers mutated payloads to get past them. | CISA | disputed | 3/3 | CISA BACS Cloudflare |
| About 6,000 potentially affected resources in Latvia, a few hundred in the public sector Primary source, one country, says 'potentially'. | CERT.LV | reported | 1/1 | CERT.LV |
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable Counted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | 1/1 | NCSC-NL |
| watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release | Daubois; CERT-EU lists a watchTowr X post among public reports | reported | 1/2 | Daubois CERT-EU |
| The fixes were released at 14:00 UTC on 21 October CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. | php.net pre-announcement; Daubois; CERT-FR (16:00 Paris) | disputed | 7/8 | oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net |
| CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog Catalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding. | CISA | confirmed | 3/3 | CISA CISA CVE record |
| Automated exploitation attempts were seen in Latvia; none succeeded Primary source. | CERT.LV | reported | 1/1 | CERT.LV |
| Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offline | CISA | confirmed | 1/1 | CISA |
| Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTC The one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | 1/1 | CERT.LV |
| The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one day Counted from the captured catalog. | CISA KEV catalog; Akamai (2024) | confirmed | 3/3 | CISA CVE record Akamai Security Research |
Its sources in the vault
- NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities US National Security Agency (NSA)
- Critical Vulnerabilities in PHP Require Immediate Patching US Cybersecurity and Infrastructure Security Agency (CISA)
- Critical security issue affecting PHP UK National Cyber Security Centre (NCSC)