PHP security report
PHP2Shell: what government agencies asked operators to do
Cybersecurity agencies asked organizations using PHP to locate affected systems and install the October 21 security updates urgently. Several also advised taking exposed systems offline when an update or adequate temporary protection could not be applied. Their wording and conditions differ, so operators should read the advice that applies to their organization.
The agencies’ instructions
PHP runs websites and is also included inside other software. An organization can therefore have affected PHP in a management tool or appliance even when its public website uses another language. The European joint statement specifically tells organizations to check these dependencies and coordinate with their suppliers.
Scroll sideways to see all columns.
| Agency and date | What it asked operators to do |
|---|---|
| CISA, October 21 | Inventory PHP and patch immediately, prioritizing internet-facing systems. Take PHP-based systems offline if they cannot be updated immediately or remain on unsupported PHP 8.1 or older. |
| UK NCSC, October 21 | Find PHP installations and update them. If updating is unavailable, assess temporary mitigations; consider going offline if those cannot be applied or would take too long. |
| Dutch NCSC, October 22 update | Keep still-vulnerable systems offline as a precaution until updates have been installed. |
| European joint statement, October 21 | Prioritize internet-facing systems and consider isolating exposed applications from public networks when immediate repair is not feasible. |
| FBI, October 23 | Update affected installations and inventory products that bundle PHP. Take a system offline until fully mitigated if an immediate update is not feasible. |
CISA’s linked copy is the bulletin sent through its official subscription service. It also says a web application firewall may offer some protection during an update. That wording does not replace its instruction to patch.
Governments reported disruption to public services
On October 22, Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four partly unavailable. She attributed most of that disruption to precautions while updates and mitigations were applied. She also said the government was not then aware of confirmed compromises of central-government systems from these vulnerabilities.
The Dutch government’s October 21 notice named Overheid.nl, MijnOverheid.nl and DigiD among sites taken offline as a precaution. It also explained that many government websites did not use PHP and were unaffected by these particular flaws.
These announcements establish disruption and the stated reasons for it. They provide no financial loss estimate, and the UK figures describe the minister’s October 22 report rather than current service availability.
Later evidence refined the risk assessment
In its October 23 afternoon update, the Dutch NCSC said it knew of one report of possible misuse abroad, without confirmation that the attack succeeded. It said exploitation appeared more difficult and large-scale misuse less likely than first estimated, while keeping its advice to install updates promptly.
Sophos also corrected its own report: its October 22 reassessment described scanning and a small number of failed attempts in customer telemetry, with no evidence of successful compromise from these flaws at that update. Neither statement is a worldwide census of victims.
PHP also published a separate session-upload-progress advisory on October 23. Administrators should review that setting guidance as well as installing the original package fixes.
Prepare a specific return-to-service decision
The UK NCSC asks organizations to check for compromise if they cannot promptly update or disable a system, and to monitor third-party products that bundle PHP. That makes the responsible administrator and package supplier central to the decision.
For each affected service, record who owns the PHP installation, the supplier’s fixed package, the required restart and the checks needed before restoring public access. If a host manages the runtime, obtain those details from the host. If suspicious activity is found, preserve the records and include an incident investigation in the recovery plan.
Sources and dates
The table links directly to agency publications. Hansard supplies the UK service count; the Dutch government supplies the named Dutch sites. Dutch-source summaries are translations. The reporting above separates the October 21 and 22 decisions from the later October 23 assessment.
Next: use the PHP2Shell check-and-verify guide to record the fixed package and running-service checks for each affected server.