The risks require immediate patching across United States Government departments and agencies

Fact-check

A6 Established●●●●●● · Advice · verdict: holds · the status word understates the evidence

NSA's own press release says 'These risks are serious enough to require immediate patching across United States Government departments and agencies.' As a statement of what NSA says, the primary record carries it, so 'reported' understates. It is NSA's statement, not a binding directive; no CISA emergency directive is visible on the CISA home page at 08:13Z.

Open tickets: Finding-74.

Graded in Run-1, resting on captures up to 2026-10-22 08:13 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-21NSA publishes NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
2. 2026-10-22 08:09 UTCSaved into the evidence vault: NSA
3. 2026-10-22 08:13 UTCSaved into the evidence vault: CISA
4. 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

The risks require immediate patching across United States Government departments and agencies
Who says it: NSA
Status: reported
Topic: advice
Sources: nsa-press-php-4630238, cisa-home