Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias

Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta, snapshot 20261022T181608Z. Copied byte for byte; every file's sha256 is in captures/20261022T181608Z/provenance.json. Publisher: SAPO Tek. Language: pt. URL: https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/

What the page says

_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_

In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP servers (1,329 with no fix possible), the public school network is the biggest block, and twelve Évora district councils were patched within six hours. He also dates Portugal's CNCS alert to the night of 20 October.

Verbatim quotes, with the watch reader's translation

Each quote is in the snapshot as served. The English is the source watch reader's translation (translations/pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta.json), not the publisher's and not checked word for word by the curator.

number: CyberS3c measured 391 Portuguese public-sector sites on 21 October: 58% show PHP, and 29 of the 66 that disclose a version run versions unsupported for six years on average.

> A CyberS3c mediu nesse dia 391 sites do setor público: 58% mostram PHP, e dos 66 que dizem que versão usam, 29 correm versões sem suporte há seis anos em média.

_Watch reader's translation:_ CyberS3c measured 391 public-sector sites that day: 58% show PHP, and of the 66 that say which version they use, 29 run versions that have been unsupported for six years on average.

number: Shodan sees 2,339 Portuguese servers announcing PHP; 1,329 have no fix at all, only replacement, and the largest block is the public school network.

> No país inteiro, o motor de pesquisa Shodan vê 2 339 servidores portugueses a anunciar PHP; para 1 329 deles não existe correção nenhuma, só substituição. O maior bloco é a rede das escolas públicas.

_Watch reader's translation:_ Across the whole country, the Shodan search engine sees 2,339 Portuguese servers announcing PHP; for 1,329 of them there is no fix at all, only replacement. The largest block is the public schools network.

patching: Twelve municipal councils in the Évora district were patched six hours after the fix because they share a professionally managed platform.

> doze câmaras do distrito de Évora estavam corrigidas seis horas depois do patch, porque partilham uma plataforma gerida a sério.

_Watch reader's translation:_ twelve councils in the Évora district were patched six hours after the patch, because they share a properly managed platform.

number: W3Techs on 21 October: 74.4% of identifiable .pt sites run PHP and 66.1% of those with a CMS use WordPress; with about 490,000 active .pt domains, that suggests over 300,000 Portuguese PHP sites (an estimate).

> Entre os sites com domínio .pt cuja tecnologia é identificável, 74,4% correm em PHP e 66,1% dos que têm gestor de conteúdos usam WordPress, segundo o W3Techs, a 21 de outubro de 2026.

_Watch reader's translation:_ Among .pt domain sites whose technology is identifiable, 74.4% run on PHP and 66.1% of those with a content management system use WordPress, according to W3Techs, on 21 October 2026.

agency: Portugal's CNCS issued an alert on the night of 20 October, after the Hacker News leak.

> Nessa noite o CNCS português emitiu um alerta.

_Watch reader's translation:_ That night the Portuguese CNCS issued an alert.

exploitation: Cloudflare was already seeing first attacks at 07:43 on 21 October, before the patch.

> Às 07h43 desse dia a Cloudflare já via os primeiros ataques, antes do patch.

_Watch reader's translation:_ At 07:43 that day Cloudflare was already seeing the first attacks, before the patch.

Why it is here

From the promotion queue (index/promote.json, priority 2): 5 new items in pt: In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP serv

Supports: translations/pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta.json

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.