Mockup C for review: a proposed design, built from the live data of release v0.10.8. Not the live site.All mockups and the design notes →
RRobin, CISOFocusStandardEverythingAsk

The analysis · government advice

16 agencies. All say update. They split on offline.

The question that divides them is not whether to patch but what to do with a system you cannot patch today. Read left to right: from no offline advice to take it offline.

In one line

The US says take it offline. The UK says that is the fourth step. Europe says isolate. Australia, Japan and the Netherlands say nothing about it.

The spectrum

every agency, by what it says to do with a system you cannot patch
6 No offline advice
EU ENISA CSIRTs NetworkAU ASD's ACSCNZ NCSCNL NCSC-NLIT ACN / CSIRT ItaliaJP JPCERT/CC
2 Consider it, or after other steps
UK NCSCCH BACS
1 Restrict access
LV CERT.LV
3 Isolate from the internet
EU CERT-EUFR CERT-FRCA CCCS
2 Take it offline
US NSA CybersecurityUS CISA

Not readable from this capture environment: CCN-CERT, CNCS.

Agency by agency

All 16Take offlineIsolateNo offline advice

NSA Cybersecurity

US
Take offline If an immediate update is not feasible, it is recommend[ed] that organizations take the system offline until it can be fully mitigated.
NSA Cyber on XNSA

CISA

US
Take offline Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be pat
CISACISA

NCSC

UK
After mitigations If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.
NCSC UK

CERT-EU

EU institutions
Isolate Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.
CERT-EU

ENISA CSIRTs Network

EU
No offline advice

An index of about 30 national advisories, work in progress: a truncated CVE in the heading and a Dutch 'en'.

ENISA CNW

CERT-FR (ANSSI)

FR
Isolate first Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue...
CERT-FR

CCCS

CA
Isolate Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.
CCCSCCCS

ASD's ACSC

AU
No offline advice

No take-offline or isolation advice. The BBC's 'Australian counterparts' framing is not supported by the page. Parts of the body are still pre-patch t

ACSCACSC

NCSC

NZ
No offline advice

The only agency to say active exploitation is reported. It does not say whose reports. Time converted from NZDT by this site.

NCSC New ZealandNCSC New Zealand

NCSC-NL

NL
No offline advice

Runs the public php2shell GitHub repository with the software inventory the UK NCSC cites, cPanel detection and mitigation scripts, and an SPDX/VEX so

NCSC-NLNCSC-NL

ACN / CSIRT Italia

IT
No offline advice

Update only. Lists the four fixed branches and no end-of-life branches.

ACN / CSIRT Italia

BACS (NCSC)

CH
Consider Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.
BACSSwiss BACS

CERT.LV

LV
Restrict from abroad Systems that cannot be updated must have internet access restricted, with no public availability until the risk is removed.
CERT.LV

JPCERT/CC

JP
No offline advice

Translations are this site's.

JPCERT/CCJPCERT/CC

CCN-CERT

ES
Could not be read

The title ('actualización inmediata') points to immediate-update advice. The block is recorded in the vault.

CCN-CERT

CNCS

PT
Could not be read

The block is recorded in the vault.

CNCS
The evidence table: every agency's words, dates and sources

On the live site this is the full table, one row per agency with the verbatim sentence, the publication time and every saved source.