On 21 October 2026 the PHP team released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell: they allow code to be run remotely on a vulnerable server without authenticating (CVSS 9.2). Institutional and business websites in several countries were taken offline pending the update. ACN’s CSIRT Italia published advisory AL07/261021/CSIRT-ITA and updated it on 23 October with a third vulnerability, CVE-2026-115560, for which fixes are still to come. Here we do not explain how to install the patch: the official advisories do that better than we can. We want to reflect on what this episode teaches us, because the real defence is staying up to date and knowing where to find the right information before you need it. FinGreenTech’s website is already up to date.
1. What the emergency taught us
- Updates never end. Every version has a life cycle: PHP 8.1 and earlier, for example, no longer receive official updates. Those who stayed on unsupported versions end up asking their supplier for extraordinary interventions or changing version in an emergency.
- Whoever is informed first acts first. CERT-EU notes that the first attack demonstrations were circulating right around the release: the window between the fix and exploitation can be very short. CSIRT Italia also reports that proofs of concept are available online for both vulnerabilities.
- Emergencies come without warning. According to the companies that found them, Calif and Wiz with the help of artificial intelligence, the flaws had been present for over ten years. They cannot be predicted: you can only be ready.
A concrete example of how fast the picture changes: the CSIRT Italia advisory was updated on 23 October, two days after it was first published, with a third vulnerability (CVE-2026-115560) and mitigation guidance pending the fixes. Anyone who had considered the matter closed after the first news may not have known.
ACN also reminds us that updating is not enough: regardless of the update, it recommends a retrospective analysis of the logs to look for signs of exploitation that may already have occurred.
2. Knowing where to look: the official channels
Waiting for the news to reach the papers, or for someone to warn us, means starting late. It is better to choose a few official sources and check them periodically, not only when there is an emergency:
- ACN and CSIRT Italia: alerts and bulletins in Italian on vulnerabilities, the first point of reference for Italian businesses. For PHP2Shell it published advisory AL07/261021/CSIRT-ITA.
- CERT-AGID: bulletins and verification tools, designed for public administrations but useful to everyone.
- ENISA: the EU cybersecurity agency. Its European Vulnerability Database (euvd.enisa.europa.eu) collects vulnerabilities, mitigation measures and exploitation status.
- CERT-EU: publishes highly technical advisories; it was created for EU institutions and is good for deeper reading rather than a source designed for SMEs.
To these you can add the official announcements of the vendors of the software you use, such as php.net for PHP.
3. Turning it into a routine
Useful information only matters if someone reads it and acts on it. That is why a small, stable organisation works best in a company:
- a responsible person, who knows who checks the channels and who to alert;
- a fixed cadence, for example weekly, and not only when the news makes noise;
- an up-to-date inventory of systems, versions and suppliers: many products embed PHP without saying so, and the Dutch agency NCSC-NL maintains a list of third-party products that may be affected;
- a log of checks, to show what was checked and when.
What about NIS2?
For those covered by NIS2, and FinGreenTech is also subject to the directive, the risk-management measures include vulnerability handling and supply-chain security. A documented update routine is exactly what you need to show you have done your part. This also applies to those who are not directly in scope but work for NIS2 entities.
Want to talk through how to organise updates and checks in your company? Book a free introductory call with FinGreenTech or write to us at info@fingreentech.com.
Sources: ACN – CSIRT Italia, advisory AL07/261021/CSIRT-ITA (updated 23/10/2026); ENISA, joint statement on critical PHP vulnerabilities (21/10/2026); CERT-EU, Security Advisory 2026-018; CERT-AGID, “PHP2Shell: tools to check exposure to the critical vulnerabilities” (22/10/2026); Il Post (21/10/2026).
Transparency note. This article was drafted with the support of artificial intelligence tools and reviewed by the FinGreenTech Team, which is editorially responsible for it.
