PHP2Shell in the EU: CERT advice and reporting duties

What the authorities advised

The advice was unusually uniform. The European Commission, ENISA, CERT-EU, Europol's cybercrime centre and the network of national CSIRTs issued a joint statement urging organisations to act immediately and, where remediation is not feasible, to consider isolating exposed applications from public networks until fixes are applied. National CERTs said the same thing in their own words.

A vulnerable version is not an incident

Running an unpatched PHP release does not by itself start a reporting clock under NIS2 or the GDPR. Both regimes run from an incident or breach that you have become aware of. What a vulnerability does create, for entities in NIS2 scope, is a risk-management duty. Article 21(2)(e) of the Directive includes vulnerability handling. For the digital infrastructure providers covered by Implementing Regulation (EU) 2024/2690, the Regulation's annex requires security patches to be applied within a reasonable time, and any decision not to patch to be documented and substantiated.

If you find a compromise: NIS2

For essential and important entities, Article 23 of NIS2 applies to a significant incident: one that has caused or can cause severe operational disruption or financial loss, or that has affected or can affect others by causing considerable material or non-material damage. For a successful PHP2Shell intrusion, the second limb deserves attention: memory disclosure can expose other users' data and credentials even where your service never went down.

Article 23(2) adds a duty that applies, where applicable, even without an incident: entities must tell the recipients of their services who are potentially affected by a significant cyber threat about the measures they can take. A hosting provider whose customers run PHP is in exactly that position.

In Latvia: the National Cyber Security Law

The National Cyber Security Law (Nacionālās kiberdrošības likums) transposes the same 24-hour, 72-hour and one-month chain in Article 34, with reports going to the competent incident response institution, CERT.LV for private entities. It adds a national duty that the Directive does not have: an entity that detects any cyber incident must inform the competent institution immediately and follow its instructions, whether or not the incident is significant. Owners of ICT critical infrastructure must also inform the competent state security institution. CERT.LV's 24/7 line is +371 6708 5888.

Article 37 of the same law allows the National Cyber Security Centre or the Constitution Protection Bureau to restrict access to domain names, IP addresses and mobile apps involved in a cyber incident or threat, for up to a year. On 21 October the Ministry of Defence said its National Cyber Security Centre had decided to limit access to state information systems running the affected PHP to Latvian IP addresses until the flaws are fixed; it did not cite the article.

If personal data were exposed: the GDPR

The confirmed impact of CVE-2026-109619 includes memory disclosure, and worker memory can hold personal data from other users' requests. Where an investigation shows that personal data were, or were likely to have been, accessed by an attacker, Article 33 requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people. Information can be provided in phases.

• A hosting provider or agency acting as processor must notify the controller without undue delay under Article 33(2); the 72-hour deadline for notifying the authority is the controller's.
• Where a high risk to people is likely, Article 34 requires telling the affected individuals as well.
• Every personal data breach must be documented under Article 33(5), including those you decide not to notify, recording the facts, its effects and the remedial action taken.
• In Latvia the supervisory authority is the Data State Inspectorate (DVI); CERT.LV's incident guidance lists a personal data leak among the facts to establish.

Financial entities: DORA

Banks, insurers, payment institutions and the other financial entities under DORA report major ICT-related incidents to their competent authority instead of under NIS2. Delegated Regulation (EU) 2025/301 sets the deadlines: the initial notification within four hours of classifying the incident as major and no later than 24 hours after becoming aware of it; an intermediate report within 72 hours of the initial notification; and a final report within a month of the last intermediate report.

DORA Article 19(2) also allows financial entities to notify significant cyber threats voluntarily when they are relevant to the financial system or to clients, without any incident having occurred.

Manufacturers: the Cyber Resilience Act

Since 11 September 2026, Article 14 of the Cyber Resilience Act has required manufacturers of products with digital elements to report actively exploited vulnerabilities in their products. Reports go to the coordinating CSIRT and ENISA through the single reporting platform: an early warning within 24 hours, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available. The EU joint statement on PHP2Shell drew attention to this duty.

It matters for vendors who ship PHP inside an appliance, a management interface or a software product. The duty is triggered by active exploitation, which the Act defines as reliable evidence that a malicious actor has exploited the vulnerability in a system without the owner's permission. By the afternoon of 22 October no official source had confirmed that for PHP2Shell: neither CISA's Known Exploited Vulnerabilities catalogue nor ENISA's EU Vulnerability Database listed either CVE as exploited, although security firms reported widespread attempts. Vendors should keep watching.