If you run PHP: every version

# If you run PHP: the steps, in order, with their sources

Inventory, patch, mitigate, shield, isolate or take offline, look for compromise, verify: every agency's php2shell advice merged into one ordered list with the sentence each step comes from.

# If you run PHP

Every agency's advice, merged into one ordered list, with the sentence each step comes from. This is a guide to what the sources say, assembled by agents and not reviewed by your security team; the php.net advisory is the authority and your national agency is the one that applies to you. Taking a system offline is the last step on every list, and the one list where it comes earlier is the one that says *isolate, then migrate*.

- 0 ### Know what you run Inventory every system with PHP serving web requests, including the ones you did not build: appliances, vendor products, hosting panels, the thing marketing bought. Do not limit discovery to old versions. Note the SAPI (mod_php, FPM, cgi, FrankenPHP, LiteSpeed) and the PHP branch.NCSC UK CISA NSA NCSC-NL
- 1 ### Patch, internet-facing first Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's backported package. Restart every worker; rebuild containers. For 7.4, 8.0 and 8.1 there is a source backport branch and no release: plan the migration now. Some third-party repositories (remirepo) had no packages on release day.php.net BACS php-src CERT-EU
- 2 ### If you cannot patch today, apply the temporary mitigations memory_limit=-1 where applications cannot override it; low post_max_size with proxy-level request limits; a cgroup memory limit instead of RLIMIT; session.upload_progress.enabled=0 then restart every worker; on 8.5 fatal_error_backtraces=0; pm.max_requests=1 on FPM. Each blocks a known path and none makes the installation safe.php.net PHP NCSC-NL
- 3 ### Put something in front A WAF may provide some protection (CISA); it is not sufficient on its own (Swiss BACS); it blocked what Cloudflare saw while attackers mutated payloads. CERT-FR's edge workaround is to block or monitor multipart Content-Type requests. Restrict access to the people and systems that need it.CISA BACS Cloudflare CERT-FR
- 4 ### Isolate or take offline Where none of the above is feasible in time: CERT-EU, Canada and France say isolate internet-facing applications from public networks; the NSA and CISA say take the system offline until fully mitigated; the UK NCSC puts this fourth; Latvia geo-blocked state services from abroad for days. Decide who can make that call and how fast it can be executed, and write it down before you need it.CERT-EU CCCS CERT-FR NSA Cyber on X CISA NCSC UK CERT.LV
- 5 ### Look for compromise PHP workers launching shells or downloading tools; unexpected files under the web root; outbound connections from the web tier; anomalous multipart or oversized requests. A clean log does not prove a clean system (JPCERT); a system that could not be patched or disabled promptly should be assessed for backdoors (NCSC UK).CISA JPCERT/CC NCSC UK NCSC New Zealand
- 6 ### Verify, then keep watching Confirm the running version after the restart, not the package version before it. Check vendors that bundle PHP for their own fixes. Watch for a follow-up release: a report that the 8.5.12 fix may be incomplete reached oss-security within two hours and has not been answered on-list.BACS NCSC-NL oss-security

## Pulling the plug, as a capability

Four agencies told organisations to be ready to take systems offline within hours. How long it takes you to do that for one system, cleanly, with a holding page and a way back, is a measurable property of your stack, and it is the property this incident tested. A system that can be removed from the internet in minutes without data loss is one you can afford to leave running until the patch is tested; a system that cannot is one you take offline early, because you will not be able to later. The site's own position is that the decision belongs to a named person and the execution belongs to a rehearsed runbook, and that the inventory in step 0 is where both start.

The technical detail behind each step is on the two flaws; which versions and products are in scope is on affected systems; what the agencies said, agency by agency, is on the agencies.