CERT-AGID Finds 650 Public Administration URLs Potentially Vulnerable to PHP2Shell
Summary
CERT-AGID's first passive scan of Italy's Public Administrations Index found 650 reachable URLs (3.2%) declaring PHP versions potentially vulnerable to PHP2Shell. Administrations were notified to verify versions and apply fixes.
Key points
- The scan identified 650 URLs—3.2% of reachable addresses in the examined Index of Public Administrations—with PHP versions declared as potentially vulnerable to PHP2Shell.
- The scan began on October 22, 2026, and used passive HTTP checks; no exploit payloads or compromise attempts were made.
- HTTP version information is only a preliminary indicator: it does not confirm installed packages, backported fixes, or whether a service is exploitable.
- The scan covered only URLs listed in the examined IPA data, not unlisted subdomains, applications, or services; missing version information does not establish that a service is unaffected.
- CERT-AGID notified administrations associated with flagged URLs and recommended that all administrations verify PHP versions and security updates, including across services outside the scan.
Article Details
- Event Type
- CERT-AGID passive HTTP assessment of public-administration URLs for potentially vulnerable PHP versions
- Impact
- The initial scan identified 650 URLs, or 3.2% of reachable URLs in the IPA list, whose HTTP headers declared a PHP version potentially vulnerable to PHP2Shell. This is a preliminary assessment, not confirmation that the services are exploitable: the scan did not send exploit payloads, and headers cannot verify installed packages or backported fixes. CERT-AGID notified the associated administrations and advised them to verify PHP versions and security updates.