CERT-AGID identifies 650 potentially vulnerable Italian public administration URLs

The Computer Emergency Response Team of the Agency for Digital Italy (CERT-AGID) has identified at least 650 URLs within the Index of Public Administrations (IPA) that are potentially vulnerable to the PHP2Shell exploit. This preliminary scan, conducted via passive HTTP header analysis on October 22, 2026, indicates that approximately 3.2% of the surveyed addresses may be running outdated PHP versions.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow for unauthenticated remote code execution. While updated PHP versions were released on October 21 to address these flaws, the installation process can take several days, leaving a window of risk.

CERT-AGID has notified the affected administrations, advising them to verify their actual running PHP versions and apply necessary security patches. The agency emphasized that because the detection relied on passive checks, the term “potentially vulnerable” is used, as HTTP headers do not always confirm the exact installed packages or applied backported fixes. Authorities recommend that system administrators and providers extend these checks to subdomains and services not explicitly listed in the IPA.