- Engineer — Act: CISA KEV listing confirms active exploitation — audit whether PHP2Shell is present in any web application or server environment and patch immediately to meet the Thursday federal deadline or your own SLA for KEV-listed vulns.
- SOC/IR — Act: Active exploitation confirmed by CISA KEV; sweep web server and application logs for PHP2Shell exploitation indicators since at least the past 30 days and tune WAF/SIEM rules to detect post-compromise activity on PHP-based endpoints.
- Leader — Plan: Confirm with engineering whether PHP2Shell is in the application inventory and that patching is tracked against the CISA deadline; if the org is a federal agency or contractor, escalate to Act and verify compliance before Thursday.