CERT-AGID Finds 467 Potentially Vulnerable URLs in Follow-Up PHP2Shell Scan
Summary
CERT-AGID’s Oct. 26 passive scan found 467 potentially vulnerable URLs among 20,117 reachable IPA-listed URLs, down from 650. It cautions that version disclosures do not confirm patch status and urges administrations to verify systems.
Key points
- The Oct. 26 scan examined the same 22,371 IPA-listed URLs as the Oct. 22 scan; 20,117 were reachable.
- The scan found 467 potentially vulnerable URLs, down from 650. Of the original 650, 453 remain potentially vulnerable and 168 now declare an updated PHP version.
- The comparison also found 14 newly detected potentially vulnerable cases; the article cautions these do not prove the vulnerabilities appeared after the first scan.
- Of the 1,409 URLs previously declaring updated PHP versions, 918 no longer exposed a version while retaining the same HTTP status. Shared publishing infrastructure makes a centralized header change plausible, but does not establish systems’ patch status.
- The passive scan made no exploitation attempts and covered only the listed URLs. CERT-AGID advised administrations to verify installed PHP versions and fixes, including backports, and check additional subdomains, applications, and services.
Article Details
- Publisher
- CERT-AGID
- Report Period
- 2026-10-22 to 2026-10-26
- Scope
- Passive monitoring of PHP vulnerability exposure among URLs in the IPA list; no exploitation attempts were made.
- Sample Size
- 22,371 IPA URLs
- Key Statistics
- On 2026-10-26, 20,117 of 22,371 URLs were reachable; 467 were classified as potentially vulnerable.
- Of the 650 URLs initially classified as potentially vulnerable, 168 (25.8%) reported an updated PHP version, 453 remained potentially vulnerable, 17 no longer exposed a detectable PHP version, and 12 did not respond within the timeout.
- The count of URLs reporting an updated PHP version fell from 1,409 to 676; 918 previously classified as updated stopped exposing the version while retaining the same HTTP status.
- The 467 potentially vulnerable results comprised 453 previously identified cases and 14 newly identified cases.
- Recommendations
- Administrations should verify with their providers the PHP versions actually in use and whether the relevant fixes, including any backports, are installed.
- Extend checks to subdomains, applications, and services not included in the IPA list; hiding the PHP version does not replace installing patches.