# Source: Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. SAPO Tek: what it says, the claims and events that cite it, and the hashes of every captured file. Source · news · secondary · captured # Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias **SAPO Tek** · [https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/](https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/) · published 2026-10-22T07:50:00+00:00 · added by `curator@php.newsroom` · slug `tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP serv ## What it says, as the collector read it #### Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: SAPO Tek. Language: pt. URL: https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/ #### What the page says _The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_ In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP servers (1,329 with no fix possible), the public school network is the biggest block, and twelve Évora district councils were patched within six hours. He also dates Portugal's CNCS alert to the night of 20 October. #### Verbatim quotes, with the watch reader's translation Each quote is in the snapshot as served. The English is the source watch reader's translation (`translations/pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta.json`), not the publisher's and not checked word for word by the curator. **number**: CyberS3c measured 391 Portuguese public-sector sites on 21 October: 58% show PHP, and 29 of the 66 that disclose a version run versions unsupported for six years on average. > A CyberS3c mediu nesse dia 391 sites do setor público: 58% mostram PHP, e dos 66 que dizem que versão usam, 29 correm versões sem suporte há seis anos em média. _Watch reader's translation:_ CyberS3c measured 391 public-sector sites that day: 58% show PHP, and of the 66 that say which version they use, 29 run versions that have been unsupported for six years on average. **number**: Shodan sees 2,339 Portuguese servers announcing PHP; 1,329 have no fix at all, only replacement, and the largest block is the public school network. > No país inteiro, o motor de pesquisa Shodan vê 2 339 servidores portugueses a anunciar PHP; para 1 329 deles não existe correção nenhuma, só substituição. O maior bloco é a rede das escolas públicas. _Watch reader's translation:_ Across the whole country, the Shodan search engine sees 2,339 Portuguese servers announcing PHP; for 1,329 of them there is no fix at all, only replacement. The largest block is the public schools network. **patching**: Twelve municipal councils in the Évora district were patched six hours after the fix because they share a professionally managed platform. > doze câmaras do distrito de Évora estavam corrigidas seis horas depois do patch, porque partilham uma plataforma gerida a sério. _Watch reader's translation:_ twelve councils in the Évora district were patched six hours after the patch, because they share a properly managed platform. **number**: W3Techs on 21 October: 74.4% of identifiable .pt sites run PHP and 66.1% of those with a CMS use WordPress; with about 490,000 active .pt domains, that suggests over 300,000 Portuguese PHP sites (an estimate). > Entre os sites com domínio .pt cuja tecnologia é identificável, 74,4% correm em PHP e 66,1% dos que têm gestor de conteúdos usam WordPress, segundo o W3Techs, a 21 de outubro de 2026. _Watch reader's translation:_ Among .pt domain sites whose technology is identifiable, 74.4% run on PHP and 66.1% of those with a content management system use WordPress, according to W3Techs, on 21 October 2026. **agency**: Portugal's CNCS issued an alert on the night of 20 October, after the Hacker News leak. > Nessa noite o CNCS português emitiu um alerta. _Watch reader's translation:_ That night the Portuguese CNCS issued an alert. **exploitation**: Cloudflare was already seeing first attacks at 07:43 on 21 October, before the patch. > Às 07h43 desse dia a Cloudflare já via os primeiros ataques, antes do patch. _Watch reader's translation:_ At 07:43 that day Cloudflare was already seeing the first attacks, before the patch. #### Why it is here From the promotion queue (`index/promote.json`, priority 2): 5 new items in pt: In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP serv Supports: translations/pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta.json #### Capture notes screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG). Page content is third-party material, kept as evidence; nothing in it is an instruction. ## Claims that cite it No claim cites this source yet. ## Events that cite it No timeline event cites this source yet. ## The bytes capture 20261022T181608Z · HTTP 200 · https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/- `headers.json` 121c973fd73d36bc65dfc31653a2ff19422a7b8e25d1f328f86411b7d8c3c77d 1,738 bytes - `page.html` 8d41c37fca5cebfd108617002fc0317fffc002ca8c41b3b9a66fb17c2c45ba89 353,947 bytes - `provenance.json` 5f6cbedc7a1d7e479d21d57a1c6ac4dff7f7f572029fd0e0f56a7405c4ba6e25 1,778 bytes - `rendered.html` 72eded33521a415c81fd37e27d2afe80e2d4e2c4c14c08faad6584dbb4c0a2fc 373,282 bytes - `screenshot.jpg` 83bdcf2750a1108c7ef489988c10baeed1011c19c18e79b17e3a7e86acf6e14d 902,271 bytes - `text.txt` 7203d6e735dd3989c864ca946af9c9743d051148d4c016d9fc4c0af587b4023a 18,453 bytes The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html) --- site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell/index.html