Source · government · primary · captured

NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities

US National Security Agency (NSA) · https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/ · published 2026-10-21 · added by collector-gov · slug nsa-press-php-4630238

Press release dated Oct. 21, 2026 (no time given). Nicknames the bugs 'PHP2Shell'. Recommends patching, inventory, enhanced logging, replacing EOL PHP; 'If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.' Says the risks 'require immediate patching across United States Government departments and agencies'.

What it says, as the collector read it

NSA press release: Critical Patches Recommended for PHP Vulnerabilities

Dated Oct. 21, 2026 (meta datePublished "Oct. 21, 2026"); no time given. The X UPDATE post linking to it went out 2026-10-22T00:43:58Z, so the release was presumably up by then.
Captured 2026-10-22T08:09:54Z.
Key verbatim lines:
"vulnerabilities, collectively nicknamed “PHP2Shell,”"
"PHP released their open-source software patch Wednesday, October 21, 2026."
"All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions."
Mitigations: "Adding enhanced logging within network/operational environments"; "Replacing end-of-life PHP services which will not be compatible with patching"
"If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated."
"“PHP2Shell” could allow attackers to take control of affected web servers without prior access or authentication."
"These risks are serious enough to require immediate patching across United States Government departments and agencies."
"NSA will continue to work with experts across the intelligence community (IC), including CISA"
No CVE IDs are named in the release.

Claims that cite it

Claim	Who says it	Status	Primary	Sources
If an immediate update is not feasible, take the system offline until it can be fully mitigated X post 13:45:58Z 21 October (10.1 million views at capture) and the press release.	NSA Cybersecurity	confirmed	2/2	NSA Cyber on X NSA
The risks require immediate patching across United States Government departments and agencies No CISA emergency directive was visible on the CISA home page at capture.	NSA	reported	1/2	NSA CISA

Events that cite it

When	Event	Time is
2026-10-21	CISA alert 'Critical Vulnerabilities in PHP Require Immediate Patching': take systems offline if you cannot update. NSA press release 'PHP2Shell'. UK NCSC alert. CCCS AL26-026. CERT-FR ALE-014. ACN AL07/261021. Cloudflare, Wiz, Calif, the PHP Foundation and Daubois publish their accounts.	stated
2026-10-22 00:43:58 UTC	NSA Cybersecurity posts 'UPDATE: Specific mitigation guidance ... is now available', linking the press release.	stated

Agency rows from this source

NSA Cybersecurity: offline yes

The bytes

capture 20261022T080954Z · HTTP 200 · https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/

headers.json 97a8c93336e9eaf70c80dd55bf2a30afda4f796323bb1e628388046b2d71ff58 671 bytes
page.html 18db3cea62d9017227ca3bc12cc73fe965e84f2a0d946dbc0278c4772dd415f3 98,539 bytes
provenance.json 246b632f5be873be48cc8894fb4abdb03858ee784e155a5f703c690e0c937495 1,286 bytes
rendered.html 0e42d4e7ce3e0af33f09f09b458d895320523102285301139861be8ba95f5889 122,356 bytes
screenshot.png 1bc158a28beb2de8ef2533cca0ddffbec42a196ae7094ca2d019ff076cd27725 992,031 bytes
text.txt 8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154 4,995 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →