NSA and CISA Maintain Recommendation to Patch or Take Offline Systems Affected by PHP2Shell

WASHINGTON — The National Security Agency issued its formal advisory on October 21 recommending immediate inventory and patching of systems running PHP, or taking them offline if an update is not feasible, after the PHP project released fixes that day for two critical remote code execution vulnerabilities nicknamed PHP2Shell.