# Prototype E: the lens, a content page

A content page that answers to two of the four settings: its length follows your time and its one line follows who you are; it reads the same whatever your aim, and the control says so.

> Prototype E for review, built from the data of release v0.18.0. Not the live site. Every part of the page is listed here; the page shows the parts that fit the reader.

## What 16 agencies advise

 1 min+ 
The agencies · in one line 
All 16 say install the fix. They split on what to do with a system you cannot patch today: 2 say take it offline. 
All 16 agencies say install the fix now. The question for you is the system you cannot patch today: 2 agencies, both American, say take it offline; decide who can make that call. 
Patch first, everywhere. For a host you cannot patch now: 2 agencies say offline, Europe says isolate from the public internet, the UK says temporary mitigations first. 
Careful with "agencies say take sites offline": 2 of 16 say so, both American. The rest say install the fix, then isolate or mitigate. 
All 16 say install the fix. They split on what to do with a system you cannot patch today: 2 say take it offline. 

 5 min+ 

### The spectrum
 every agency, by what it says to do with a system you cannot patch 

 6 No offline advice 
 EU ENISA CSIRTs Network AU ASD's ACSC NZ NCSC NL NCSC-NL IT ACN / CSIRT Italia JP JPCERT/CC 

 2 Consider it, or after other steps 
 UK NCSC CH BACS 

 1 Restrict access 
 LV CERT.LV 

 3 Isolate from the internet 
 EU CERT-EU FR CERT-FR CA CCCS 

 2 Take it offline 
 US NSA Cybersecurity US CISA 
Not readable from this capture environment: CCN-CERT, CNCS. 

 15 min+ 

### Agency by agency
 each in its own words, with its saved sources 

#### NSA Cybersecurity
 US 
 Take offline 
 If an immediate update is not feasible, it is recommend[ed] that organizations take the system offline until it can be fully mitigated. 

 NSA Cyber on X NSA NSA Cyber on X 

#### CISA
 US 
 Take offline 
 Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated. 

 CISA CISA CISA 

#### NCSC
 UK 
 After mitigations 
 If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated. 

 NCSC UK 

#### CERT-EU
 EU institutions 
 Isolate 
 Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified. 

 CERT-EU 

#### ENISA CSIRTs Network
 EU 
 No offline advice 

An index of about 30 national advisories, work in progress: a truncated CVE in the heading and a Dutch 'en'. 

 ENISA CNW 

#### CERT-FR (ANSSI)
 FR 
 Isolate first 
 Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue... 

 CERT-FR 

#### CCCS
 CA 
 Isolate 
 Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied. 

 CCCS CCCS 

#### ASD's ACSC
 AU 
 No offline advice 

No take-offline or isolation advice. The BBC's 'Australian counterparts' framing is not supported by the page. Parts of the body are still pre-patch text. 

 ACSC ACSC 

#### NCSC
 NZ 
 No offline advice 

The only agency to say active exploitation is reported. It does not say whose reports. Time converted from NZDT by this site. 

 NCSC New Zealand NCSC New Zealand 

#### NCSC-NL
 NL 
 No offline advice 

Runs the public php2shell GitHub repository with the software inventory the UK NCSC cites, cPanel detection and mitigation scripts, and an SPDX/VEX source list. 

 NCSC-NL NCSC-NL NCSC-NL 

#### ACN / CSIRT Italia
 IT 
 No offline advice 

Update only. Lists the four fixed branches and no end-of-life branches. 

 ACN / CSIRT Italia 

#### BACS (NCSC)
 CH 
 Consider 
 Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary. 

 BACS Swiss BACS 

#### CERT.LV
 LV 
 Restrict from abroad 
 Systems that cannot be updated must have internet access restricted, with no public availability until the risk is removed. 

 CERT.LV 

#### JPCERT/CC
 JP 
 No offline advice 

Translations are this site's. 

 JPCERT/CC JPCERT/CC 

#### CCN-CERT
 ES 
 Could not be read 

The title ('actualización inmediata') points to immediate-update advice. The block is recorded in the vault. 

 CCN-CERT 

#### CNCS
 PT 
 Could not be read 

The block is recorded in the vault. 

 CNCS 

 All+ 
### The evidence table

Every agency with its publication time, its exact words, what it says of exploitation, and its sources: on the live agencies page . 

That is the page for the time you gave it.

---
site v0.18.0 · https://php.oct.2026.newsroom.sgit.ai/admin/design/lens/agencies/index.html