Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offline

Fact-check

A6 Established●●●●●● · Advice · verdict: holds

CISA's alert says organisations that cannot update immediately, or that use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until patched or updated. The party's own record carries it.

Open tickets: Finding-88.

Graded in Run-1, resting on captures up to 2026-10-22 08:13 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-21CISA publishes Critical Vulnerabilities in PHP Require Immediate Patching
2. 2026-10-22 08:13 UTCSaved into the evidence vault: CISA
3. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offline
Who says it: CISA
Status: confirmed
Topic: advice
Sources: cisa-alert-php-20261021