NSA and FBI Issue Joint Emergency Advisory on PHP2Shell Vulnerabilities Triggering Government Shutdowns in Ten Countries

Analysis
We assess with high confidence that exposure is serious, based on exploitation Amazon recorded before disclosure, attack counts Cloudflare reported rising into the millions, and consistent reporting across all four sources that no victim has been named. Those sources draw on distinct vendor and agency statements rather than a single wire, so the agreement carries weight. The most exposed first victims are unpatchable end-of-life PHP branches and edge appliances, including Palo Alto Networks firewalls without fixed releases. A government agency, major vendor, or credible security firm will likely publicly confirm a successful compromise of a named victim organization through CVE-2026-109618 or CVE-2026-109619 by November 7. Secrets disclosed from memory stay usable after patching, so shutdowns buy time, not safety, and operators who cannot patch now must isolate internet-facing PHP hosts. Governments in at least ten countries have gone offline, and the FBI has joined the NSA in advising isolation. Shutdowns and patch uptake may instead have closed the window before exploits matured, leaving downtime and unnamed intrusions victims never disclose. A confirmed victim would push security teams from shutdown to breach response, secret rotation and incident reporting. Absence of one would let agencies restore patched services and redirect resources to end-of-life PHP migration.