Pluribus One

23/10/2026

PHP2SHELL (CVE-2026-109618 e CVE-2026-109619) è una coppia di vulnerabilità critiche che risiedono nell'interprete PHP stesso e non nel codice delle singole applicazioni. Un attaccante remoto può sfruttarle senza alcuna autenticazione, inviando una semplice richiesta HTTP per eseguire codice arbitrario sul server, installare webshell e accedere a credenziali, chiavi API e dati. Poiché le falle riguardano il motore di PHP, qualsiasi servizio basato su questo linguaggio è potenzialmente esposto, a prescindere dal framework adottato.

L'impatto operativo è amplificato dalla disponibilità dei correttivi: le patch ufficiali coprono unicamente le versioni supportate (PHP 8.2 e successive), lasciando scoperte le versioni 8.1 e precedenti. Inoltre, l'aggiornamento immediato dei sistemi risulta spesso complesso in presenza di architetture articolate o applicativi legacy.

Per rispondere a questa minaccia, Pluribus One ha integrato nei moduli di rilevazione di SEER BOX (la nostra soluzione di Application Detection & Response) la capacità di identificare e bloccare i tentativi di sfruttamento di PHP2SHELL.

Il deployment non invasivo di Seer Box consente di attivare la protezione contro PHP2Shell senza alcun impatto sull’operatività delle applicazioni.

Questo consente di presidiare l'infrastruttura durante la pianificazione degli aggiornamenti di PHP e di garantire la copertura dei sistemi legacy per i quali non saranno rilasciate patch ufficiali.

👉 𝗦𝗲 𝘃𝘂𝗼𝗶 𝘀𝗮𝗽𝗲𝗿𝗻𝗲 𝗱𝗶 𝗽𝗶𝘂̀ 𝘀𝘂𝗹𝗹𝗮 𝗻𝘂𝗼𝘃𝗮 𝗶𝗻𝘁𝗲𝗴𝗿𝗮𝘇𝗶𝗼𝗻𝗲, 𝗰𝗼𝗻𝘁𝗮𝘁𝘁𝗮𝗰𝗶:
https://www.pluribus-one.it/contact-us

23/10/2026

When you have a winning team and a winning spot, you stick with it! 🚀

For the second year in a row, our Cyber Journey returns to the stunning Emerson Beach Club!

We’re bringing back the exact same unique vibe: sea views, cutting-edge cybersecurity discussions, top-tier networking, and a relaxed, informal atmosphere.

Ready to ride the wave with us at Cyber Journey 2027?
🗓️ Save the date and stay tuned. More updates are coming soon!

22/10/2026

Approving and overseeing cybersecurity measures is no longer solely the responsibility of the IT department: Article 23 of Legislative Decree 138/2024 assigns direct, personal accountability for cyber risk management to governing bodies.

Cybersecurity thus takes center stage on the Board of Directors' agenda, where a lack of oversight leads directly to personal liability and administrative penalties for corporate leadership.

In this environment, blindly trusting technological automation without real corporate oversight creates a false sense of security. No algorithm, no matter how advanced, can replace contextual evaluation and human judgment when navigating complex events.

The true role of technology is not to replace business decision-making, but to empower it with visibility and deep analytical insight, illuminating what traditional tracking misses.

Providing clear, transparent frameworks enables executive leadership to make informed decisions and formally document their actions. It is precisely at this intersection of advanced analytics and human governance that organizational defense transforms from a regulatory burden into a sustainable governance model.

21/10/2026

Last week, Pluribus One participated alongside Alfa Group at Cybertech Europe 2026, one of the leading international events dedicated to cybersecurity innovation and industry trends. 🚀​

We took advantage of this exceptional setting to showcase our European projects, with a special focus on CyberSuite.

CyberSuite aims to make advanced cybersecurity accessible to SMEs lacking dedicated resources. By establishing a unified marketplace of interoperable, streamlined security services, the project simplifies the deployment and management of high-level protection, privacy, and trust.

We extend our gratitude to the event organizers and to all the participants whose contributions and insights during the networking sessions made the event a significant success! 💯

14/10/2026

In the landscape of critical infrastructure and financial markets, treating vendor security as a standalone topic is a strategic flaw: operational damage caused by third parties is, in every respect, equivalent to an internal vulnerability.

Strategic vendors, maintenance providers, and API-integrated partners already possess privileged access channels and authorized credentials to interact with the core infrastructure. When an attacker compromises a link in the supply chain, they don't need to breach the perimeter: they simply leverage the partner's legitimate access to move undetected through core systems.

The expansion of liability introduced by Legislative Decree 138/2024 reflects this exact continuity of impact: in the event of a service disruption or data breach, non-compliance with security posture standards and the resulting reputational damage fall entirely on the primary organization.

Despite this reality, third-party risk management is still often entrusted to static tools such as due diligence questionnaires or periodic contract reviews. These formal checks certify intentions on paper, yet remain completely blind to the exact moment an external communication channel is manipulated.

Building a true defense requires shifting from bureaucratic verification to continuous, analytical traffic monitoring.

Isolating inbound external traffic and monitoring its behavior in real time is the only way to intercept an anomaly before a supply chain vulnerability escalates into a business disruption—while simultaneously providing objective, documentable evidence for ACN compliance.

12/10/2026

08/10/2026

An advanced cyber attack never announces its arrival using patterns or indicators already known to the market.
Relying solely on reactive tools to protect your application systems means accepting a dangerous gamble: it assumes that for a threat to be blocked, it must have already been identified and cataloged elsewhere.

The strategic challenge lies precisely in the blind spot between the discovery of a new vulnerability and the availability of its technical "antidote". During this window of exposure, leadership faces a threefold risk:

📍​Operational Risk - the sudden disruption of core services or the quiet, ongoing manipulation of business transactions.

📍​Legal and Compliance Risk - detecting the intrusion so late that complying with mandatory notification deadlines (such as the strict 24-hour threshold under the NIS2 directive) becomes impossible.

📍​Financial and Reputational Risk - the loss of market trust, alongside administrative penalties imposed on executive board members.

Shifting the defense model from identifying individual threats to the continuous analysis of normal baseline traffic radically transforms this dynamic.
Instead of chasing lists of past threats, the infrastructure becomes capable of isolating any anomalous or deviant behavior the exact moment it occurs. You don't need to know the attacker's identity to stop their action.

For corporate governance, this shift is not merely a technical choice, but a strategic decision to close the business vulnerability window before it turns into systemic damage.

07/10/2026

Ensuring compliance with regulations like NIS2 and the Cyber Resilience Act (CRA) requires concrete tools and operational solutions.

At the "Building Cyber Resilience in the Digital Era" event held in Athens and organized by the EU projects DETANGLE, CRACoWi, and INCIDENTRON, Davide Ariu (CEO of Pluribus One and APPtake project coordinator) brought our hands-on experience to the stage.

During his talk, he presented and demonstrated a live demo of APPTake, showing how to make security management simpler and more flexible for organizations.

We would like to thank the entire consortium and all participants for the warm welcome and the valuable discussions during the workshop.

If you want to learn more about Apptake project, visit the website!
👉​ https://www.apptake.eu/

29/09/2026

Cyber Journey - OWASP Italy Day returns!
Save the date: Thursday, June 17th 📆