CERT-EU, NCSC and CISA issue alerts as some sites go offline

The official advice

Three national or regional bodies published advice within a day of the PHP release. CERT-EU’s advisory 2026-018 recommends immediate patching, vendor backports where available, and isolation of internet-facing applications if patching cannot happen immediately. The UK NCSC said organisations using any version of PHP are affected, told them not to limit discovery to outdated versions, and advised considering taking a system offline if mitigations cannot be applied quickly.

CISA, according to CyberScoop, said it had not observed exploitation at the time of publication and urged immediate patching. Japan’s IPA published its alert on 22 October without asserting that exploitation had been observed. These statements are not identical, and the difference matters.

Where the agencies differ

The agencies are describing the same technical situation with different evidence cut-offs. “No exploitation observed by this agency at this time” is narrower than “no exploitation has occurred”. It is also narrower than “the vulnerability is not being exploited”. Readers should preserve that distinction instead of compressing it into a single reassuring sentence.

The practical advice converges. Patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Restart PHP workers. If that is impossible, apply the official interim controls and reduce exposure, with isolation as the fallback when the controls cannot be applied quickly. Then look for evidence of compromise, because a clean application log does not clear a host.

Sites going offline

SecurityWeek reported that hundreds of sites went offline on 21 October, including European government, hospital and school sites. That is a real operational choice, not a failure of the advisory. For an organisation that cannot verify its PHP runtime quickly, taking a service offline can be safer than serving requests through an exposed worker. The cost is availability; the decision belongs to the operator, not to a generic checklist.