CERT-AGID Finds Fewer URLs Reporting Potentially Vulnerable PHP Versions, Releases Tools
Summary
CERT-AGID found 382 of 22,371 IPA-listed URLs (1.7%) reporting potentially vulnerable PHP versions, down from 650. The decline does not confirm remediation; AgID also released scripts to check and update systems.
Key points
- In its October 29, 2026, passive check of 22,371 IPA-listed addresses, CERT-AGID found 382 URLs (1.7%) reporting potentially vulnerable PHP versions, down from 650 on October 22.
- Of the URLs initially flagged, 215 now report an updated version; 47 more changed to reporting an updated version since the October 26 check.
- The reduction does not confirm that all affected systems were fixed: some URLs stopped exposing the PHP version or could not be reached.
- The check used no payloads or exploitation attempts and covered only the listed addresses, not additional subdomains, applications, or services.
- CERT-AGID notified administrations about newly flagged cases and sent reminders about previously reported URLs that still indicate potentially vulnerable versions.
- AgID published scripts to check installed PHP packages, install updates, apply temporary mitigations, and identify signs requiring further investigation.
- AgID advises qualified staff to test scripts in a replica environment, prepare backups, and schedule maintenance; temporary mitigations do not replace security updates.
Article Details
- Event Type
- Passive assessment of potentially vulnerable PHP versions across public-administration web addresses and release of remediation tools.
- Impact
- On 29 October 2026, 382 of 22,371 examined IPA web addresses (1.7%) declared a potentially vulnerable PHP version, down from 650 in the initial 22 October assessment. Of the initially flagged addresses, 215 now declare an updated version; 47 more changed from potentially vulnerable to reportedly updated since the 26 October check. These findings do not confirm remediation: some addresses stopped exposing their PHP version or were unreachable, and the check used no exploit attempts or payloads.
Products
FedoraAgID ha pubblicato nel proprio repository PHP2Shell su GitHub gli strumenti utilizzati per verificare e correggere i propri server, principalmente Ubuntu e, in misura minore, Fedora.PHPLa ricognizione del CERT-AGID del 29 ottobre 2026 mostra un ulteriore miglioramento: l’1,7% degli indirizzi IPA esaminati dichiara una versione PHP potenzialmente vulnerabile.UbuntuAgID ha pubblicato nel proprio repository PHP2Shell su GitHub gli strumenti utilizzati per verificare e correggere i propri server, principalmente Ubuntu e, in misura minore, Fedora.