Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R04 Services lost to precautionary shutdowns / R04-3
R04-3: The agencies' advice disagrees
Because the agencies worded their offline advice differently, from 'take offline' to 'consider taking offline', and reports of allied agreement were contradicted, boards in different countries made opposite calls on the same facts, resulting in outages some did not need and exposure others did not see.
Rating 12 high · Likelihood 4 Likely · Impact 3 Significant · Kind Governance · Acceptance not recorded
Basis. The allies' joint advice is contradicted by the captures; the wording differs per agency.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| Agencies and CERTs | source | Wrote the advice. | 11 risks |
| Board and executives | owner | Reads it and decides. | 5 risks |
| The press | informer | Summarised it as one voice. | 6 risks |
What it arises from
- Numbers and ratings repeated without their source. 70% of the Internet, CVSS 10, 30 million sites: figures that measure different things, carried from post to post until they read as fact.
The evidence
| Claim | Status | Fact-check | Sources |
|---|---|---|---|
| 'Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated' | disputed | A2 Reported●●○○○○ | BBC News NCSC UK CCCS |
| The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking systems offline where patching is not feasible | contradicted | A1 Weak signal●○○○○○ | BBC News ACSC CERT-EU NCSC-NL ACN / CSIRT Italia JPCERT/CC |
| If an immediate update is not feasible, take the system offline until it can be fully mitigated | confirmed | A6 Established●●●●●● | NSA Cyber on X NSA |
| Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offline | confirmed | A6 Established●●●●●● | CISA |
Treatments
| Treatment | Status | Where |
|---|---|---|
| The agencies table, advice side by side | in place | What sixteen agencies actually advise |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| ISO/IEC 27001 | A.5.5 | Contact with authorities | Management-system standards |
| NIST CSF 2.0 | GV.RR-01 | Leadership is responsible and accountable for cybersecurity risk | Frameworks and control catalogues |
| NIS2 | Art.20 | Governance: management bodies approve and oversee the risk-management measures and can be held liable | Law and regulation |
The stories that tell it
- Where php2shell stands: many sites dark, millions of attempts, no confirmed breach
- php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof (through Services lost to precautionary shutdowns)
On this site: What sixteen agencies actually advise