# Source: PHP2Shell, allarme CSIRT Italia: l’81,9% dei servizi PHP risulta vulnerabile - Matrice Digitale

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Matrice Digitale: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell, allarme CSIRT Italia: l’81,9% dei servizi PHP risulta vulnerabile - Matrice Digitale

**Matrice Digitale** · [https://www.matricedigitale.it/2026/10/25/php2shell-italia-csirt-servizi-php-vulnerabili/](https://www.matricedigitale.it/2026/10/25/php2shell-italia-csirt-servizi-php-vulnerabili/) · published 2026-10-25T19:00:32+01:00 · added by `curator@php.newsroom` · slug `matricedigitale-2026-10-25-php2shell-italia-csirt-serviz`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Matrice Digitale (Italian), 25 October: CSIRT Italia's alert (AL01/1025/PHP2Shell) puts 285,149 PHP services on potentially vulnerable versions, 81.9%...

## What it says, as the collector read it

#### PHP2Shell, allarme CSIRT Italia: l’81,9% dei servizi PHP risulta vulnerabile - Matrice Digitale

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/matricedigitale/2026-10-25-php2shell-italia-csirt-servizi-php-vulnerabili`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Matrice Digitale (Italian), 25 October: CSIRT Italia's alert (AL01/1025/PHP2Shell) puts 285,149 PHP services on potentially vulnerable versions, 81.9% of the 348,130 services with an identified version. It recaps the two CVEs (9.2) and a third, CVE-2026-115560, for which no patch exists and the CSIRT recommends a vendor-published mitigation, and tells administrators, hosting providers and infrastructure managers to act at once. It notes the picture is mainly one of delay in updating internet-exposed installations. Same alert as the CyberSecItalia item (cybersecitalia-lalert-dellacn-in-italia-a-rischio-vulne), which gives the 741,523 total.

> Il CSIRT Italia rileva 285.149 servizi PHP con versioni potenzialmente vulnerabili a PHP2Shell, pari all’81,9% dei 348.130 servizi con versione identificata.

_Curator's translation:_ "CSIRT Italia detects 285,149 PHP services with versions potentially vulnerable to PHP2Shell, equal to 81.9% of the 348,130 services with an identified version."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell, allarme CSIRT Italia: l’81,9% dei servizi PHP risulta vulnerabile - Matrice Digitale". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `it-IT`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261026T094033Z · HTTP 200 · https://www.matricedigitale.it/2026/10/25/php2shell-italia-csirt-servizi-php-vulnerabili/- `headers.json` 7a1305bf666e6a2771e96c700bb39be9136880208ee0d1a0abaed3c8fc16fb2d 1,385 bytes
- `page.html` 12f2aaa6aa46c1691bb3e05988bc51116b218b240dbcf842937a484c8787667b 226,540 bytes
- `provenance.json` 297069294036d662a4f9a1297215bd23090736123f582af42734d7964dded715 1,804 bytes
- `rendered.html` aca3a00dcea719e4cb2e996afdeb5b9fac55bf84aaf4ac1721903e66c17b3392 572,517 bytes
- `screenshot.jpg` 586a260e0692044a27d57404ba870f4022765cd42598a5fb36f4f4e78ce2a9f4 754,405 bytes
- `text.txt` d54477d226a71e71e9289195b5a9bcb4070e477413f90c63c2ff40b513d5acbc 14,393 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/matricedigitale-2026-10-25-php2shell-italia-csirt-serviz/index.html