Follow-Up: PHP2Shell Response Enters Day Two as NSA, FBI and CISA Detail Patch-or-Offline Steps and the National Writers Union Takes Its Site Down as a Precaution

The response to PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, entered its second day as the U.S. National Security Agency (NSA) issued a formal advisory, jointly with the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA), urging immediate fixes. The advisory confirms the flaws sit in PHP itself rather than in any hosted application or configuration, can let attackers take over vulnerable web servers with no prior access, and carry a CVSS v4.0 score of 9.2.

The agencies set out a sequence of steps: inventory everything relying on vulnerable PHP versions, prioritizing internet-facing servers and third-party products that bundle PHP; add logging; replace end-of-life PHP versions that cannot be patched; and, if an immediate update is not feasible, take systems offline until they are fully mitigated. The NSA said it is prioritizing identifying malicious actors who may exploit the flaws, and called the risk serious enough to require immediate patching across U.S. government departments and agencies.

The PHP team's fixes, released on October 21, are versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For unsupported branches from 7.4 to 8.1, only minimal code fixes are provided, and there is no fix for 5.4 to 7.3. According to W3Techs, PHP runs on about 69.3% of websites whose server-side language it can identify, and widely used systems including WordPress, Drupal and Joomla are built on it. Technical details leaked before the patch, and Cloudflare chief executive Matthew Prince has said exploit attempts reached hundreds of thousands within two hours of disclosure and millions thereafter.

In the United States, the National Writers Union has notified its members that it proactively took its own website offline as a security precaution because of PHP2Shell, and urged members who run PHP websites to check and update them. The union's site was taken down preventively; it was not breached. A day earlier, UK technology minister Baroness Lloyd of Effra told the House of Lords that 32 UK government services were unavailable and four partially unavailable, largely due to precautionary measures, and that the National Cyber Security Centre had sent 50,000 warnings to businesses and organizations. Government websites in the Netherlands, Finland, Denmark, France and Germany have also been taken offline as a precaution, and Japanese Prime Minister Sanae Takaichi has urged website owners to patch.

The flaws were reportedly found with SI assistance: security firm Calif found one of the bugs using an SI model, while Google's Wiz independently uncovered both with SI tools. Amazon's AWS says attackers were exploiting the flaws four days before public disclosure. As of publication, the U.S. government has not publicly confirmed any federal website shutdowns caused by the vulnerabilities.

Source: GSM · USA (original Chinese edition)

Photo: 位于马里兰州Fort Meade的美国国家安全局总部。（Wikimedia Commons，Public domain，National Security Agency）Headquarters of the U.S. National Security Agency at Fort Meade, Maryland. (Wikimedia Commons, Public domain, National Security Agency)

Latest in Technology

OpenAI Cuts Funding Target by $10 Billion: Now Seeking $20 Billion at a $1.25 Trillion Valuation2026-10-31NRC Completes Safety Review of Xe-100 as Advanced Reactor Moves Toward Construction Permit2026-10-31