# @NSACyber: Organizations using PHP should prepare for update fixing two critical

Source: https://x.com/NSACyber/status/2112903220209098897
Kiwi News: https://news.kiwistand.com/stories/NSACyber-Organizations-using-PHP-should-prepare-for-update-fixing-two-critical?index=0x6ad8de7e4e4f398e38187ef3ad50631ab7d575a9acb7cc894f13a3728277d09656693c85
Submitted by tim on 2026-10-21 UTC, 1 upvote, 0 comments

## Summary

The NSA's Cybersecurity Directorate advised organizations using PHP to prepare for an update fixing two critical vulnerabilities, effective immediately. The advisory says PHP is widely used for web applications and that these vulnerabilities often provide a direct path to the server's file system or database. It recommends taking affected systems offline if an immediate update is not feasible, and says NSA will follow up shortly with more specific guidance.

## Article

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.