PHP2Shell, l’allerta ACN copre oltre 285mila siti italiani

PHP2Shell, l’allerta ACN copre oltre 285mila siti italiani

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page it/news/sbircialanotizia/articoli-2026-10-26-php2shell-italia-lstfv, snapshot 20261028T094557Z. Copied byte for byte; every file's sha256 is in captures/20261028T094557Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

An Italian magazine explainer (Sbircia la Notizia, 26 October) on ACN's alert, which per ACN as reported by Adnkronos covers more than 285,000 Italian sites; it stresses that exposure is a technical condition and that compromise needs separate evidence in each server's logs and files. It gives the patched PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), notes that the CMS update does not fix the PHP runtime, that the actual release serving HTTP must be checked (the command-line version can differ), that PHP processes must be restarted after updating, and that PHP 8.1 and earlier are out of support, with minimal source backports offered for 7.4, 8.0 and 8.1. It relays CERT-EU (install now, isolate exposed applications if that is not possible) and the UK NCSC (suspend public access for systems that cannot be updated or mitigated quickly), mentions an informational advisory of 23 October about a further, less likely flaw (CVE-2026-115560), and cites Reuters on an attempt Amazon saw against a decoy system on 17 October and other activity on 21 October before the embargo ended.

> L’allerta riguarda oltre 285mila siti italiani

_Curator's translation:_ "The alert covers more than 285,000 Italian sites."

Why it is here

From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell, l’allerta ACN copre oltre 285mila siti italiani". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language it. Secondhand on ACN, CERT-EU, the NCSC and Reuters. The page explains how the flaws work and which configuration a further flaw needs; none of that is copied into the notes. Nothing in the page addresses an AI or hides text from a reader.