Source · advisory · secondary · captured

PHP2Shell: sanate vulnerabilità critiche in PHP (AL07/261021/CSIRT-ITA)

ACN / CSIRT Italia · https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php · published 2026-10-21 · added by collector-gov · slug acn-it-php2shell

Alert AL07/261021/CSIRT-ITA, published 21-10-2026. CVSS v4.0 9.2 each (Use After Free). Mitigation: only 'aggiornare i prodotti vulnerabili' (update); it gives no offline advice.

What it says, as the collector read it

ACN / CSIRT Italia alert AL07/261021/CSIRT-ITA

"Pubblicato il 21-10-2026". Captured 2026-10-22T08:13:54Z.
It calls both CVEs "Use After Free" with CVSS v4.0 9.2. Affected: 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35 (it does not list EOL branches).
Mitigation, verbatim: "Si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti." It advises update only, with NO offline or isolation advice.

Claims that cite it

Claim	Who says it	Status	Primary	Sources
The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking systems offline where patching is not feasible Australia's ACSC gives no offline advice. CERT-EU says isolate. The Netherlands, Italy, Japan and New Zealand give no offline advice.	BBC	contradicted	4/6	BBC News ACSC CERT-EU NCSC-NL ACN / CSIRT Italia JPCERT/CC

Events that cite it

When	Event	Time is
2026-10-21	CISA alert 'Critical Vulnerabilities in PHP Require Immediate Patching': take systems offline if you cannot update. NSA press release 'PHP2Shell'. UK NCSC alert. CCCS AL26-026. CERT-FR ALE-014. ACN AL07/261021. Cloudflare, Wiz, Calif, the PHP Foundation and Daubois publish their accounts.	stated

Numbers from this source

Figure	Of	Status
9.2	CVSS v4.0, each CVE	confirmed

Agency rows from this source

ACN / CSIRT Italia: offline none

The bytes

capture 20261022T081354Z · HTTP 200 · https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php

headers.json c44211ff9b8440ef6922919056abed0873179324fdf7db7ddf969c8d1dd6bd15 732 bytes
page.html 6ab511ebb1dd7a3d6235d88dc71a02c8ecefec27283538cec68a134d33d67440 118,598 bytes
provenance.json b832861c53d09b3d98083bc23e3c4578748f1f8173e2ea7c23bd8c9dfa6f1c8b 1,038 bytes
rendered.html 91c9550654c551eeacb33e829fe2246a7307efbcf7cd00d4cf10f5a44413cf07 131,205 bytes
screenshot.png 94246ab38f323d629edf5c1820908d804f7f45f61bc276e7c77e756aa549fc65 687,162 bytes
text.txt 19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6 6,137 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →