The agencies: every version

# What sixteen agencies actually advise

The NSA, CISA, the UK NCSC, CERT-EU, ENISA, CERT-FR, Canada, Australia, New Zealand, the Netherlands, Italy, Switzerland, Latvia, Japan, Spain and Portugal on php2shell: who says take it offline, who says isolate, who says patch and nothing more, and who has seen exploitation.

# The agencies, side by side

16 national and supranational bodies, each read from its own page. The question that divides them is not whether to patch (all say patch) but what to do with a system that cannot be patched now. Of 16: 6 say *none*, 2 say *yes*, 2 say *isolate*, 2 say *unknown*, 1 say *after mitigations*, 1 say *isolate first*, 1 say *consider*, 1 say *restrict from abroad*. Two could not be read because their sites block automated browsers; the block is recorded.

The BBC's morning framing, *the UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking systems offline*, holds for the NSA and CISA, is a simplification of the NCSC's fourth of six steps, and is not supported by the Australian page at all. The sentence the BBC quotes from the NCSC is not on the NCSC page as captured; its opening matches the Canadian text.

| Agency | Published | Offline? | Exploitation | Note | Sources |
|---|---|---|---|---|---|
| **NSA Cybersecurity** US | 2026-10-21T13:45:58Z (X post); press release dated 21 Oct | yesIf an immediate update is not feasible, it is recommend[ed] that organizations take the system offline until it can be fully mitigated. | not stated | The X post says 'be prepared for an update', so it reads as written before or with the patch. The press release names no CVE IDs and calls the pair 'PHP2Shell'. | NSA Cyber on X NSA NSA Cyber on X |
| **CISA** US | 2026-10-21 | yesOrganizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated. | none observed at publication; neither CVE in KEV as of catalog 2026.10.21 | 'A web application firewall may provide some protection until systems are updated or patched.' The most absolute offline advice, and it covers end-of-life versions explicitly. | CISA CISA CISA |
| **NCSC** UK | 2026-10-21 (page modified 2026-10-22T07:30:02Z) | after mitigationsIf you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated. | not stated | Offline is the fourth of six priority actions, after inventory, update and the PHP Foundation's temporary mitigations. The sentence the BBC quotes ('Where immediate remediation is not feasible...') is not on the page as captured; the page changed on 22 October. | NCSC UK |
| **CERT-EU** EU institutions | 2026-10-21 15:20:18 (timezone not stated) | isolateWhere that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified. | PoCs circulating; 'raises the likelihood that attackers are already exploiting' | States the fixes were released at 13:30 UTC. Lists the PHP temporary mitigations in full. | CERT-EU |
| **ENISA CSIRTs Network** EU | 2026-10-21 | noneThe Mitigation field still holds template placeholder text. | not stated | An index of about 30 national advisories, work in progress: a truncated CVE in the heading and a Dutch 'en'. | ENISA CNW |
| **CERT-FR (ANSSI)** FR | 2026-10-21 | isolate firstLe CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue... | not stated | The closest to 'isolate first, then patch'. Lists all 5.x, 6.x, 7.x, 8.0 and 8.1 as affected. Workarounds: session.upload_progress off; block multipart Content-Type at a WAF. | CERT-FR |
| **CCCS** CA | 2026-10-21 | isolateWhere immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied. | PoC available, no active exploitation identified | The opening of this sentence is the one the BBC attributes to the UK NCSC. The wording is shared across Five Eyes and CERT-EU text. | CCCS CCCS |
| **ASD's ACSC** AU | 2026-10-21, reviewed 2026-10-22 | noneIdentify PHP, review php.net, apply updates and mitigations, monitor. | not aware of successful active exploitation within Australia | No take-offline or isolation advice. The BBC's 'Australian counterparts' framing is not supported by the page. Parts of the body are still pre-patch text. | ACSC ACSC |
| **NCSC** NZ | 2026-10-21T20:15Z (09:15 NZDT, 22 Oct); updated 21:20Z | noneUpdate to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; apply the remediation as soon as possible; investigate unauthorised access or compromise. | 'The NCSC is aware of reports of active exploitation.' | The only agency to say active exploitation is reported. It does not say whose reports. Time converted from NZDT by this site. | NCSC New Zealand NCSC New Zealand |
| **NCSC-NL** NL | 2026-10-21T15:25Z (README last significant change) | noneIf immediate patching is not possible, follow PHP's temporary mitigations... PHP states that these measures are not complete fixes. | public PoC exists; no active abuse seen (portal banner) | Runs the public php2shell GitHub repository with the software inventory the UK NCSC cites, cPanel detection and mitigation scripts, and an SPDX/VEX source list. | NCSC-NL NCSC-NL NCSC-NL |
| **ACN / CSIRT Italia** IT | 2026-10-21 | noneSi raccomanda di aggiornare i prodotti vulnerabili. | not stated | Update only. Lists the four fixed branches and no end-of-life branches. | ACN / CSIRT Italia |
| **BACS (NCSC)** CH | 2026-10-21 (home-page teaser dated 20 Oct) | considerCheck, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary. | not stated | 'Even a web application firewall alone is not sufficient', which contrasts with CISA. Says containers may need to be rebuilt. | BACS Swiss BACS |
| **CERT.LV** LV | 2026-10-21T15:25Z; updated 20:00Z (converted from EEST) | restrict from abroadSystems that cannot be updated must have internet access restricted, with no public availability until the risk is removed. | automated exploitation attempts seen, none successful | Latvia geo-blocked several state digital resources from abroad, possibly until 26 October. The unified state website platform was patched by 20:00Z; lsm.lv and 112.lv restored. Translations are this site's. | CERT.LV |
| **JPCERT/CC** JP | 2026-10-22 | noneAfter sufficient testing, apply the fixed version promptly; investigate whether you have been compromised. | not stated; warns that one detection rule may miss attacks | Translations are this site's. | JPCERT/CC JPCERT/CC |
| **CCN-CERT** ES | unknown | unknownNot read: HTTP 403 bot challenge to every fetch. | unknown | The title ('actualización inmediata') points to immediate-update advice. The block is recorded in the vault. | CCN-CERT |
| **CNCS** PT | unknown | unknownNot read: HTTP 513 browser-verification challenge. | unknown | The block is recorded in the vault. | CNCS |

Each agency's full text is in its capture; the sentences here are the ones the collectors copied verbatim into their notes. Translations from French, Italian, Latvian and Japanese are this site's and are marked as such in the notes.