# Source: PHP2Shell: sanate vulnerabilità critiche in PHP (AL07/261021/CSIRT-ITA)

ACN / CSIRT Italia: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · advisory · secondary · captured

# PHP2Shell: sanate vulnerabilità critiche in PHP (AL07/261021/CSIRT-ITA)

**ACN / CSIRT Italia** · [https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php](https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php) · published 2026-10-21 · added by `collector-gov` · slug `acn-it-php2shell`

Alert AL07/261021/CSIRT-ITA, published 21-10-2026. CVSS v4.0 9.2 each (Use After Free). Mitigation: only 'aggiornare i prodotti vulnerabili' (update); it gives no offline advice.

## What it says, as the collector read it

#### ACN / CSIRT Italia alert AL07/261021/CSIRT-ITA

- "Pubblicato il 21-10-2026". Captured 2026-10-22T08:13:54Z.

- It calls both CVEs "Use After Free" with CVSS v4.0 9.2. Affected: 8.5

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking systems offline where patching is not feasibleAustralia's ACSC gives no offline advice. CERT-EU says isolate. The Netherlands, Italy, Japan and New Zealand give no offline advice. | BBC | contradicted | 4/6 | [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html) [ACSC](../../sources/acsc-alert-php/index.html) [CERT-EU](../../sources/certeu-sa-2026-018/index.html) [NCSC-NL](../../sources/ncsc-nl-php2shell/index.html) [ACN / CSIRT Italia](../../sources/acn-it-php2shell/index.html) [JPCERT/CC](../../sources/jpcert-at260033/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-21 | CISA alert 'Critical Vulnerabilities in PHP Require Immediate Patching': take systems offline if you cannot update. NSA press release 'PHP2Shell'. UK NCSC alert. CCCS AL26-026. CERT-FR ALE-014. ACN AL07/261021. Cloudflare, Wiz, Calif, the PHP Foundation and Daubois publish their accounts. | stated |

### Numbers from this source

| Figure | Of | Status |
|---|---|---|
| 9.2 | CVSS v4.0, each CVE | confirmed |

### Agency rows from this source
- [ACN / CSIRT Italia](../../agencies/index.html): offline none

## The bytes
capture 20261022T081354Z · HTTP 200 · https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php- `headers.json` c44211ff9b8440ef6922919056abed0873179324fdf7db7ddf969c8d1dd6bd15 732 bytes
- `page.html` 6ab511ebb1dd7a3d6235d88dc71a02c8ecefec27283538cec68a134d33d67440 118,598 bytes
- `provenance.json` b832861c53d09b3d98083bc23e3c4578748f1f8173e2ea7c23bd8c9dfa6f1c8b 1,038 bytes
- `rendered.html` 91c9550654c551eeacb33e829fe2246a7307efbcf7cd00d4cf10f5a44413cf07 131,205 bytes
- `screenshot.png` 94246ab38f323d629edf5c1820908d804f7f45f61bc276e7c77e756aa549fc65 687,162 bytes
- `text.txt` 19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6 6,137 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/acn-it-php2shell/index.html