# Source: NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities

US National Security Agency (NSA): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · government · primary · captured

# NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities

**US National Security Agency (NSA)** · [https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/) · published 2026-10-21 · added by `collector-gov` · slug `nsa-press-php-4630238`

Press release dated Oct. 21, 2026 (no time given). Nicknames the bugs 'PHP2Shell'. Recommends patching, inventory, enhanced logging, replacing EOL PHP; 'If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.' Says the risks 'require immediate patching across United States Government departments and agencies'.

## What it says, as the collector read it

#### NSA press release: Critical Patches Recommended for PHP Vulnerabilities

- Dated Oct. 21, 2026 (meta datePublished "Oct. 21, 2026"); no time given. The X UPDATE post linking to it went out 2026-10-22T00:43:58Z, so the release was presumably up by then.

- Captured 2026-10-22T08:09:54Z.

- Key verbatim lines:

- "vulnerabilities, collectively nicknamed “PHP2Shell,”"

- "PHP released their open-source software patch Wednesday, October 21, 2026."

- "All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions."

- Mitigations: "Adding enhanced logging within network/operational environments"; "Replacing end-of-life PHP services which will not be compatible with patching"

- "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated."

- "“PHP2Shell” could allow attackers to take control of affected web servers without prior access or authentication."

- "These risks are serious enough to require immediate patching across United States Government departments and agencies."

- "NSA will continue to work with experts across the intelligence community (IC), including CISA"

- No CVE IDs are named in the release.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| If an immediate update is not feasible, take the system offline until it can be fully mitigatedX post 13:45:58Z 21 October (10.1 million views at capture) and the press release. | NSA Cybersecurity | confirmed | 2/2 | [NSA Cyber on X](../../sources/nsa-x-2112903220209098897/index.html) [NSA](../../sources/nsa-press-php-4630238/index.html) |
| The risks require immediate patching across United States Government departments and agenciesNo CISA emergency directive was visible on the CISA home page at capture. | NSA | reported | 1/2 | [NSA](../../sources/nsa-press-php-4630238/index.html) [CISA](../../sources/cisa-home/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-21 | CISA alert 'Critical Vulnerabilities in PHP Require Immediate Patching': take systems offline if you cannot update. NSA press release 'PHP2Shell'. UK NCSC alert. CCCS AL26-026. CERT-FR ALE-014. ACN AL07/261021. Cloudflare, Wiz, Calif, the PHP Foundation and Daubois publish their accounts. | stated |
| 2026-10-22 00:43:58 UTC | NSA Cybersecurity posts 'UPDATE: Specific mitigation guidance ... is now available', linking the press release. | stated |

### Agency rows from this source
- [NSA Cybersecurity](../../agencies/index.html): offline yes

## The bytes
capture 20261022T080954Z · HTTP 200 · https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/- `headers.json` 97a8c93336e9eaf70c80dd55bf2a30afda4f796323bb1e628388046b2d71ff58 671 bytes
- `page.html` 18db3cea62d9017227ca3bc12cc73fe965e84f2a0d946dbc0278c4772dd415f3 98,539 bytes
- `provenance.json` 246b632f5be873be48cc8894fb4abdb03858ee784e155a5f703c690e0c937495 1,286 bytes
- `rendered.html` 0e42d4e7ce3e0af33f09f09b458d895320523102285301139861be8ba95f5889 122,356 bytes
- `screenshot.png` 1bc158a28beb2de8ef2533cca0ddffbec42a196ae7094ca2d019ff076cd27725 992,031 bytes
- `text.txt` 8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154 4,995 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/nsa-press-php-4630238/index.html