NSA Cybersecurity
USIf an immediate update is not feasible, it is recommend[ed] that organizations take the system offline until it can be fully mitigated.
What 16 agencies advise
1 min+
The agencies · in one line
All 16 say install the fix. They split on what to do with a system you cannot patch today: 2 say take it offline.
All 16 agencies say install the fix now. The question for you is the system you cannot patch today: 2 agencies, both American, say take it offline; decide who can make that call.
Patch first, everywhere. For a host you cannot patch now: 2 agencies say offline, Europe says isolate from the public internet, the UK says temporary mitigations first.
Careful with "agencies say take sites offline": 2 of 16 say so, both American. The rest say install the fix, then isolate or mitigate.
All 16 say install the fix. They split on what to do with a system you cannot patch today: 2 say take it offline.
5 min+
The spectrum
every agency, by what it says to do with a system you cannot patch6 No offline advice
EU ENISA CSIRTs NetworkAU ASD's ACSCNZ NCSCNL NCSC-NLIT ACN / CSIRT ItaliaJP JPCERT/CC
2 Consider it, or after other steps
UK NCSCCH BACS
1 Restrict access
LV CERT.LV
3 Isolate from the internet
EU CERT-EUFR CERT-FRCA CCCS
2 Take it offline
US NSA CybersecurityUS CISA
Not readable from this capture environment: CCN-CERT, CNCS.
15 min+
Agency by agency
each in its own words, with its saved sources
Take offline
CISA
USOrganizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
NCSC
UKIf you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.
CERT-EU
EU institutionsWhere that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.
ENISA CSIRTs Network
EUAn index of about 30 national advisories, work in progress: a truncated CVE in the heading and a Dutch 'en'.
CERT-FR (ANSSI)
FRLe CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue...
CCCS
CAWhere immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.
ASD's ACSC
AUNo take-offline or isolation advice. The BBC's 'Australian counterparts' framing is not supported by the page. Parts of the body are still pre-patch text.
NCSC
NZThe only agency to say active exploitation is reported. It does not say whose reports. Time converted from NZDT by this site.
NCSC-NL
NLRuns the public php2shell GitHub repository with the software inventory the UK NCSC cites, cPanel detection and mitigation scripts, and an SPDX/VEX source list.
ACN / CSIRT Italia
ITUpdate only. Lists the four fixed branches and no end-of-life branches.
BACS (NCSC)
CHCheck, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.
CERT.LV
LVSystems that cannot be updated must have internet access restricted, with no public availability until the risk is removed.
JPCERT/CC
JPTranslations are this site's.
CCN-CERT
ESThe title ('actualización inmediata') points to immediate-update advice. The block is recorded in the vault.
CNCS
PTThe block is recorded in the vault.
All+
The evidence table
Every agency with its publication time, its exact words, what it says of exploitation, and its sources: on the live agencies page.
That is the page for the time you gave it.