Celebrating 40 Years of Compliance Leadership

php2shell Update

On October 20th, PHP announced that two critical vulnerabilities had been discovered and would be fully disclosed and patched as of October 21st at 14:00 UTC, collectively referred to as php2shell.

The announcement has caused a stir in the web community, with several websites being taken completely offline while waiting for the release to become available.

While there is evidence that the vulnerabilities were being exploited even before the PHP updates were released, sites protected by Cloudflare’s firewalls, like DISA.com, were protected. OpenAI, who discovered the vulnerabilities, coordinated with Cloudflare in preparation, and they deployed emergency firewall rules across their entire network prior to the disclosure, mitigating potential attacks.

Upon learning of these vulnerabilities, DISA immediately initiated a coordinated, enterprise-wide assessment to identify all instances of PHP usage and evaluate potential security exposure.

Additionally, our managed security operations partner has conducted proactive threat-hunting activities associated with these vulnerabilities and reported no evidence of successful exploitation. We will continue enhanced security monitoring as we complete our remediation activities.

square-pattern dots
circular-pattern dots

The limited number of internet-facing PHP instances identified were patched immediately. We are remediating additional PHP installations operating within private, non-internet-facing networks through October 22, 2026, as part of our broader vulnerability management process.

Importantly, DISA maintains a layered security architecture that incorporates enterprise-wide security telemetry, endpoint detection and response (EDR), behavioral threat monitoring, and automated malware prevention. These capabilities provide compensating controls designed to identify and disrupt suspicious activity, including malicious code execution, unauthorized process activity, and other potential indicators of exploitation, while remediation activities are completed.

DISA's corporate website and screening applications operate in separate environments. The continued availability of DISA.com during this period should not be interpreted as an absence of security measures or remediation activity. Protecting our customers' information remains a fundamental priority. We continue to monitor our environment closely and work with our security operations partners to validate the effectiveness of our protective measures and complete all necessary remediation activities.