The CERT-AGID he identified 650 URLs that declare a PHP version potentially vulnerable to PHP2Shellequal to 3.2% of the reachable addresses registered in the Public Administration Index (IPA). The data comes from the first survey, started on 22 October 2026. The administrations associated with the affected addresses have been notified.
The detection was based exclusively on passive HTTP checks, which analyze the information made available by the servers. CERT-AGID did not send exploitative payloads or perform any compromise attempts. The version declared in the HTTP headers does not allow you to verify the installed packages or any fixes applied via backport, and the wording “potentially vulnerable” does not confirm the exploitability of the service.
The perimeter includes only the URLs in the IPA list used for crawling. Subdomains, applications and services not explicitly registered were not searchedeven when attributable to the same administration, therefore the results do not provide a complete census of the PA’s web exposure. Some servers do not expose the PHP version and others may not use PHP: in both cases remote control is inconclusive, and the absence of a detectable version does not demonstrate the absence of vulnerabilities.
CERT-AGID asks the notified administrations to check the PHP version actually running and applying security fixes. The verification is recommended even for those who have not received any reports and must extend to subdomains, applications and services outside the examined list. System administrators and suppliers must be involved; the technical details and update indications are in the previous CERT-AGID communication on PHP2Shell vulnerabilities.
CERT-AGID also reminds you that do not publicly display the PHP version it is a good configuration practice, foreseen by the official PHP documentation, because it reduces the information available to a potential attacker. The data describes the situation of the first scan: the current state of the services could be different, also due to the updates already made by administrations and suppliers.
