# Fact: The risks require immediate patching across United States Government departments

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The risks require immediate patching across United States Government departments and agencies Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · advice · reported

# The risks require immediate patching across United States Government departments and agencies

**Who says it:** NSA · **Sources:** [NSA](../../sources/nsa-press-php-4630238/index.html) [CISA](../../sources/cisa-home/index.html)

No CISA emergency directive was visible on the CISA home page at capture.

## Fact-check

**A6** Established●●●●●● · Advice · verdict: **holds** · the status word understates the evidence

NSA's own press release says 'These risks are serious enough to require immediate patching across United States Government departments and agencies.' As a statement of what NSA says, the primary record carries it, so 'reported' understates. It is NSA's statement, not a binding directive; no CISA emergency directive is visible on the CISA home page at 08:13Z.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [nsa-press-php-4630238](../../sources/nsa-press-php-4630238/index.html) | carries | *These risks are serious enough to require immediate patching across United States Government departments and agencies.* | 8a8553ea1ffcd794 |
| [cisa-home](../../sources/cisa-home/index.html) | absent | *Critical Vulnerabilities in PHP Require Immediate Patching* | ab2aa07bb46ba14c |

Open tickets: [Finding-74](../../factcheck/index.html#Finding-74).

Graded in Run-1, resting on captures up to 2026-10-22 08:13 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21NSA publishes [NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities](../../sources/nsa-press-php-4630238/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: NSA
- 2026-10-22 08:13 UTCSaved into the evidence vault: CISA
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
CCaseyWebsite ownerTTaylorProject or programme managerJJordanBoard member or executiveSSamSecurity leadRRowanJournalistRRobinCISOAAveryCTOMMorganData protection officerJJamieHead of AppSecRRileyCommunications team
And on [every claim](../../claims/index.html#gov-patch-required).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
The risks require immediate patching across United States Government departments and agencies
Who says it: NSA
Status: reported
Topic: advice
Sources: nsa-press-php-4630238, cisa-home
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/gov-patch-required/index.html