If an immediate update is not feasible, take the system offline until it can be fully mitigated

Fact-check

A6 Established●●●●●● · Advice · verdict: holds

Both of NSA's own pages carry the advice in nearly the claim's words: the press release ('it is recommended that organizations take the system offline until it can be fully mitigated') and the X post (with the typo 'recommend'). The X post's snowflake decodes to 2026-10-21T13:45:58Z and the capture shows 10.1M views, as the note says.

Graded in Run-1, resting on captures up to 2026-10-22 08:09 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-21NSA publishes NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
2. 2026-10-21 13:45 UTCNSA Cyber on X publishes NSA Cyber on X: Effective Immediately ... two critical vulnerabilities
3. 2026-10-22 08:09 UTCSaved into the evidence vault: NSA Cyber on X
4. 2026-10-22 08:09 UTCSaved into the evidence vault: NSA
5. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

If an immediate update is not feasible, take the system offline until it can be fully mitigated
Who says it: NSA Cybersecurity
Status: confirmed
Topic: advice
Sources: nsa-x-2112903220209098897, nsa-press-php-4630238