NSA Urges Immediate Patching of PHP2Shell Flaws Allowing Unauthenticated Server Takeover
Summary
The NSA recommends immediate patching of PHP vulnerabilities nicknamed PHP2Shell, which it says can let attackers control affected web servers without authentication. PHP released its open-source patch on Oct. 21, 2026. The agency says the flaws require immediate patching across U.S. government departments and agencies.
Key Points
- The NSA says organizations should take systems offline if an immediate PHP update is not feasible.
- The NSA says PHP2Shell flaws are in PHP itself, not in the hosted application or its configuration.
- The NSA names CISA as an intelligence community partner in addressing PHP2Shell vulnerabilities.