In Italy 285 thousand websites at risk: anyone can take control of them

Over 285 thousand Italian websites are exposed to the risk of cyber attacks. Hackers, but also cyber collectives linked to "state actors" such as Russia, could exploit two serious vulnerabilities to access systems without knowing credentials, steal user data, modify pages or completely interrupt services. The alarm comes from the National Cybersecurity Agency (ACN), which published two separate security bulletins in the space of three days. An unprecedented circumstance.

The flaws concern PHP, one of the most used software for the operation of websites, from public administration portals to e-commerce platforms. The updates to correct the vulnerabilities are already available, but over eight out of ten sites, among those verified by the Agency, have not yet installed them.

The problem lies in PHP, the software that works behind the scenes of most sites: it makes the forms to be filled out, the cart of an online shop, the reserved area of ​​a municipality or a company work. Two very serious flaws, with a threat score of 9.2 out of 10, allow anyone to give orders to the site from outside. And instructions for doing so are already circulating online: the Agency speaks of "recent attempts at exploitation".

According to data from the National Cybersecurity Agency, updated to October 25, 741,523 websites using PHP have been identified in Italy.

Of these, for 348,130 it was possible to verify the installed software version. The result highlights a critical situation: 285,149 sites, equal to 81.9% of those checked, still use vulnerable versions. Only 62,981 are updated.