# Source: PHP2Shell, l’allerta ACN copre oltre 285mila siti italiani

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Sbircia la Notizia Magazine: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell, l’allerta ACN copre oltre 285mila siti italiani

**Sbircia la Notizia Magazine** · [https://www.sbircialanotizia.it/articoli/2026/10/26/php2shell-italia-lstfv/](https://www.sbircialanotizia.it/articoli/2026/10/26/php2shell-italia-lstfv/) · published 2026-10-26 · added by `curator@php.newsroom` · slug `sbircialanotizia-articoli-2026-10-26-php2shell-italia-lst`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T094557Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). An Italian magazine explainer (Sbircia la Notizia, 26 October) on ACN's alert, which per ACN as reported by Adnkronos covers more than 285,000 Italian...

## What it says, as the collector read it

#### PHP2Shell, l’allerta ACN copre oltre 285mila siti italiani

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/sbircialanotizia/articoli-2026-10-26-php2shell-italia-lstfv`, snapshot `20261028T094557Z`. Copied byte for byte; every file's sha256 is in `captures/20261028T094557Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

An Italian magazine explainer (Sbircia la Notizia, 26 October) on ACN's alert, which per ACN as reported by Adnkronos covers more than 285,000 Italian sites; it stresses that exposure is a technical condition and that compromise needs separate evidence in each server's logs and files. It gives the patched PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), notes that the CMS update does not fix the PHP runtime, that the actual release serving HTTP must be checked (the command-line version can differ), that PHP processes must be restarted after updating, and that PHP 8.1 and earlier are out of support, with minimal source backports offered for 7.4, 8.0 and 8.1. It relays CERT-EU (install now, isolate exposed applications if that is not possible) and the UK NCSC (suspend public access for systems that cannot be updated or mitigated quickly), mentions an informational advisory of 23 October about a further, less likely flaw (CVE-2026-115560), and cites Reuters on an attempt Amazon saw against a decoy system on 17 October and other activity on 21 October before the embargo ended.

> L’allerta riguarda oltre 285mila siti italiani

_Curator's translation:_ "The alert covers more than 285,000 Italian sites."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell, l’allerta ACN copre oltre 285mila siti italiani". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `it`. Secondhand on ACN, CERT-EU, the NCSC and Reuters. The page explains how the flaws work and which configuration a further flaw needs; none of that is copied into the notes. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261028T094557Z · HTTP 200 · https://www.sbircialanotizia.it/articoli/2026/10/26/php2shell-italia-lstfv/- `headers.json` a11e69ea8669f377e772da460b3e79675f599da7bb7b8ea3d129e31fae1b71ce 528 bytes
- `page.html` 15ae9d3c00739eac9ed635b3c085fff8ed022a5f02f5d917937cc78a8270f6d0 89,590 bytes
- `provenance.json` 2dfdbf92ba2e16252c2b020d3a6ebaf07d61765c2ff30f5999628f661894e648 1,712 bytes
- `rendered.html` db270a7bf9ecce4bd58c4cee875e853aa196712571202ec7e8066bebeadd9bed 89,675 bytes
- `screenshot.jpg` 6f2600471fb39856a83a18ee123f3da4188f40e8306ed16f9745f54af8e5d5fd 820,068 bytes
- `text.txt` 398ecd2cfea4d72a6f1fe7218a15b7c224d91cf51b21418201eef1df932e966d 16,205 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.51 · data as of 2026-10-28T17:15Z · vault commit 75668aedfb6d · https://refs.php.oct.2026.newsroom.sgit.ai/sources/sbircialanotizia-articoli-2026-10-26-php2shell-italia-lst/index.html