Digital news for October 2026: AI Act decree, tracking pixels in emails and PHP vulnerabilities
Since October 23, the European AI Act legislative decree has been in effect. From October 29, tracking pixels in emails require information and consent. On October 21, PHP released patches for PHP2Shell, two critical vulnerabilities that allow remote code execution on unpatched servers.
Index
October was not exactly a quiet month for those working in the digital sector.
A law It has come into force, a expiration date It has arrived and one vulnerability It forced the entire web to update its servers quickly.
These are three different stories, but they have one thing in common: They concern you too, If you have a website, Send it newsletter o use artificial intelligence in the company.
In this article, we have explained them without going into too much detail and accompanied them with the next steps we recommend you take.
The 3 news of October 2026 in summary
If you have only 1 minute, Here's what happened, when and who has to move.
Below you will find all the details in one place.
- Decree AI Act 179/2026, in force since October 23, 2026. It concerns companies, professionals and public authorities that use AI systems. What to do: map the tools used, train those who use them and update the information for workers.
- Guidelines from the Guarantor regarding tracking pixels, adjustment by October 29, 2026. They concern who sends newsletters and emails with opening statistics. What to do: update the information and registration forms, provide for the revocation of tracking.
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619), patch of October 21, 2026. It applies to anyone who has a site or application in PHP, including WordPress. What to do: Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and check the sites.
1 Decree AI Act 179/2026: what changes in Italy from October 23
The AI Act has been in effect since 2024, but until now there had been a missing piece in Italy: who controls and who punishes.
From October 23, 2026 that little piece is there.
Legislative Decree 179/2026 does not rewrite the European rules: it just makes them Applicable, with authorities, procedures and Fines.
For companies, this means that AI used without discretion ceases to be just a theoretical problem.
What is Legislative Decree 179/2026
Legislative Decree No. 179 of October 7, 2026, adapts Italian legislation to EU Regulation 2024/1689, that is the AI Act. It was published in Official Gazette On October 7, it has 54 articles and is In force since October 23, 2026.
Be careful not to confuse it with Legislative Decree 160/2026: They are two separate acts, and the 179th is the second adjustment decree, with its own obligations.
In addition to supervision and sanctions, the text disciplines the regulatory sandboxes (controlled spaces for experimenting with AI systems), l‘use of AI’ in work and training in regulated professions.
AgID and ACN: who oversees artificial intelligence in Italy
The decree entrusts the national powers of supervision and Sanction to two subjects: AgID (Agency for Italy Digital) and ACN (National Cybersecurity Agency). They are coordinated by a single contact point and a coordination committee.
Translated:From now on, there is someone who can ask you how you use AI and ask you to demonstrate it.
For this reason the internal documentation becomes important: list of the instruments used, purposes, who supervises them and what training has been given.
AI Act sanctions: up to €35 million or 7% of turnover
The maximum penalty reaches 35 million euros or 7% of the annual global turnover, if higher. Applies to: practices prohibited by Article 5 of the AI Act, such as behavior manipulation or social scoring.
Not all violations cost millions.
For those with low offensive or dangerous potential, the decree also provides for non-monetary measures in lieu of a fine.
The message, however, is clear: the’The AI Act is now biting back.
Artificial intelligence and work: the final decisions remain with a single person
This is definitely the new thing with l‘most immediate impact’.
If a company uses AI in processes related to staff, The final decision on the hiring, modification and termination of the relationship must be made by to be entrusted to a natural person. The same applies to Measures disciplinary regulations and assessments Performance.
The AI can then to help to select a CV or to read data, but It cannot be her decision.
And the person who decides must have real power: an automatic “yes” put under the algorithm’s choice is not enough.
Those who work with these systems must also be able to receive clear explanations of the decisions supported by AI.
Has the AI Act been postponed? What changes with the Digital Omnibus
No, or rather: only in part.
The Digital Omnibus, that is, EU Regulation 2026/1744 in force since July 27, 2026, has The obligations on high-risk systems have been shifted forward, in particular. Everything else kept its dates.
- Prohibited practices (Art. 5): No postponement, in effect from February 2, 2025.
- Literacy on AI (Article 4): No postponement, in effect from February 2, 2025.
- Transparency and marking of content (Art. 50), systems already on the market: from August 2, 2026 to December 2, 2026.
- Autonomous high-risk systems (Annex III): from August 2, 2026 to December 2, 2027.
- High-risk systems integrated into products (Annex I): from August 2, 2027 to August 2, 2028.
In short, reading “delay” as “pause” is the most common mistake for those who are not familiar with legislation.
Those who use AI for work already have it today Existing obligations, Starting from the formation of people.
AI Act: what companies need to do now
You don't need an internal legal department to get started. You need order and some decisions made in time:
- Map out the AI tools you use. Chatbots, text and image generators, HR software, CRM with predictive features: list everything, including who uses them and for what purpose.
- It shapes people. AI literacy is an existing requirement, not an optional course.
- Review the processes that affect staff. If AI is involved in selection, evaluation, or measures, the final decision must remain with a person.
- Updates information and internal procedures. Anyone who works with you must know when and how AI enters into decisions that affect them.
- Documenta. In the event of an inspection, what you can prove counts, not what you declare.
If AI has also entered your content and campaigns, we discussed it in this article on our blog: “From SEO to GEO: why in 2026 strategic copywriting is the real driver of your online visibility”, where we explain how GEO is changing online visibility.
2 Tracking pixels in emails: the Privacy Guarantor guidelines in force since October 29th
The open rate of your newsletter has a price, and from this month it is called consensus.
The 29th of October 2026 is the deadline to comply has expired to the guidelines of Privacy Guarantor on tracking pixels in emails. Who sends newsletters, DEMs or commercial emails with Opening statistics he must have updated information, Consents and systems of revocation.
What is a tracking pixel
A tracking pixel is a transparent image with a single point on the screen.
It is not inside the email: it is hosted on a remote server and it charges when the message arrives Open. At that moment communicates to the person who sent the email that something has happened.
According to the Guarantor, depending on the case, the pixel can collect IP address, device used, Reading time and number of openings. It can also detect whether the message was cancelled, forwarded o Closed.
If you didn’t know, this is the mechanism behind almost all the opening statistics for email marketing platforms.
What does measure 284/2026 of the Guarantor provide?
The guidelines were adopted with the Decree No. 284 of April 17, 2026 and published in Official Gazette No. 98 of April 29, 2026. The six-month deadline for compliance is expires on October 29, 2026, As the Guarantor recalled in the press release of October 5th.
The central point is the legal framework. The Guarantor treats the pixel as a access to the user’s device, governed by Article 122 of the Privacy Code: the same logic of cookie.
In general, therefore, use is prohibited without prior consent, except in certain exceptions.
The guidelines also clarify the roles. The person who decides the purposes and means of the tracking is the data controller, Even if the The operational part is entrusted to an external platform.
In a nutshell: the tracking information must always be provided, regardless of the type of email and who the sender is, whether public or private.
Consent to tracking pixels in newsletters: how to obtain it
The good news is that two checkboxes are not necessary. Consent to tracking can be given collected together with that for receiving promotional communications. The text of the opt-in must, however, say so in a clear and unambiguous way. explicit and neutral: A consent to the newsletter that does not mention tracking does not cover tracking.
For the registered members you already have, The guidelines require that introduce and communicate a mechanism to revoke consent, even just for tracking purposes. This is the part more difficult from a technical point of viewThe platform must be able to send an email to a single contact without pixels and without tracked links.
When tracking pixels do not require consent
The Guarantor provides for certain Exceptions where the pixel can be used without specific consent:
- statistics in aggregated form;
- security purposes;
- strictly necessary technical requirements;
- communications due, institutional or service-related.
In these cases too, proportionality and data minimization apply. The Guarantor also recommends: Privacy measures by design, For example, avoid having the recipient’s email address be included in the request generated by the pixel.
Inspections by the Data Protection Commissioner and checklist for email marketing
The deadline is not just formal. With the measure no. 545 of July 23, 2026, the Guarantor included the verification of these guidelines in the Planning plan for August-December 2026. The controls are therefore already scheduled.
If you haven’t already done so, here's where to start:
- Check whether your delivery platform uses tracking pixels and links, and what options it has released to adapt.
- Update the privacy policy with a section dedicated to tracking pixels: operation, data collected, purposes, legal basis, retention and revocation.
- Modify the newsletter registration form by explicitly mentioning tracking.
- Inform current subscribers how to revoke their consent to tracking.
- Check that the platform can exclude individual contacts from being tracked who request it.
- Review the KPIs: if a portion of the subscribers is no longer tracked, the open rate changes in meaning.
The last point counts more than it seems. A newsletter is measured in terms of clicks, responses, and conversions, not just in terms of opens.
Digital marketing
Strategy and creativity
Branding, social media, graphic design and digital advertising: we build consistent and strategic communication to grow your project.
3 PHP2Shell: critical vulnerabilities CVE-2026-109618 and CVE-2026-109619
On October 21st PHP had a bad day, and with it a good chunk of the web.
Two have been corrected critical vulnerabilities that allow to run code remotely on unupdated servers. It’s not the fault of any single plugin: it’s the language on which most websites are built, including WordPress.
What are PHP2Shell vulnerabilities
PHP2Shell is the name given to two vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619. Both have a CVSS v4.0 score of 9.2 out of 10 and allow an attacker to: Unauthorized attacker executing code on the server, with the privileges of the web process.
- CVE-2026-109618 It is activated when PHP runs out of memory while preparing a request. Some data remains built in the middle and the cleanup code handles them as valid, paving the way for the execution of code.
- CVE-2026-109619 It is created from information that survives at the end of a request, after the memory that contained it has been freed. If the same process handles a subsequent request, it can read that data that is no longer valid.
The timing made things worse.
The details were leaked online on October 20, a day before the patches were released. According to Datadog, AWS detected attempts to exploit the vulnerabilities as early as October 17. On October 26, the U.S. CISA agency added both vulnerabilities to its list of actively exploited vulnerabilities.
Which servers and sites are exposed (including WordPress)
It is on display any PHP installation that responds to web requests, Regardless of the site or application that runs on it. PHP-FPM, Apache with mod_php (in PHP terms, the most risky case), php-cgi, FrankenPHP, and LiteSpeed are involved.
So yes: WordPress, WooCommerce, management systems, and APIs written in PHP are all affected, if the server is not updated.
And the site’s login is unprotected: PHP processes the malicious request before any application code is involved. Palo Alto Networks estimated that there were over 22.6 million potentially vulnerable instances exposed online.
Corrected PHP versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35
The solution is Update PHP to one of these versions, or the correct package released by your hosting provider or your Linux distribution:
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
You can find the official notices on php.net.
There is one Temporary mitigation that blocks the known attack path, but does not replace the updateEven the analysts who described it advise against considering it a definitive solution.
If your site is on WordPress and You don't know which version of PHP you are using, You can verify it from board in Tools > Site Health > Info > Server.
How we managed the PHP update on our servers
Some online say that it resolves in three seconds, maybe by asking the AI. On a single website, maybe. On dozens of servers and projects in production, no.
We needed them hours.
We have updated all the machines, Then we have Every site and service has been checked again, One by one. PHP updates are the fast part. The part that takes time is check that everything that revolves around us still worksForm, payments, integrations, reserved areas.
For the WordPress sites we follow with our technical management It was an urgent, but ordinary intervention: it updates, occurs, and closes.
1 subscription 0 worries
With WeggPress your WordPress site is managed every month by professionals, with updates, security, backups, hosting and support included.
Sites and administrations with obsolete PHP versions: why the risk is greater
For anyone who has a website or software that has been frozen for years, the problem is much bigger.
Official corrections have been released for branches from 8.2 and up. Those who remained on older versions it does not have a patch to install: it must first be upgraded.
And jumping from an old version of PHP to a newer one often breaks something: themes, plugins, and custom-written functions that have never been updated. Until you are able to update, you remain exposed.
It is here that an intervention from a few hours ago can become a project to be managed with a custom development, like the ones we follow with Synextya.
Custom development and technologies at your service
Integrations, automations, and custom functionalities: with Synextya We transform complex needs into solid solutions.
Security and digital compliance: what the October news teaches us
A law, a privacy deadline and a vulnerability. They seem like three different worlds, but the pattern is the same: Those who move when the news comes out arrive late.
Those who already had a list of the AI tools they used lived with the decree 179 with ease. Those who knew their own email sending platform updated their information and forms in one afternoon. Those who maintained their own servers closed PHP2Shell in a few hours.
The others are still sweating.
And one thing is clear: security and compliance cannot be improvised.
They are being built every day, one by one. continuous maintenance of the site, of the date and of processes. It's not the most fun part of digital, but it's the part that It prevents you from experiencing the worst surprises.
If you want to understand where to start and/or seek technical support, request a consultation.
Digital innovations coming in November and December 2026 (+ 1 for 2027)
Memorize these dates:
- Until December 2026: inspections by the Guarantor. The August-December planning plan includes the verification of the guidelines on tracking pixels. Those who have not yet adapted have little time.
- December 2, 2026: AI transparency (art. 50). The extension for AI systems already on the market expires before August 2, 2026. It concerns the transparency obligations and the labeling of AI-generated content, such as watermarks.
- In the coming weeks: PHP2Shell. With public exploits circulating, attempts to attack unpatched servers will continue. It is worth checking that test, staging, and old subdomains have also been updated.
In just over a year, on December 2, 2027, the obligations for high-risk AI systems will come into effect. We will discuss them again.
FAQ on digital news in October 2026
The most frequently asked questions that we have received from our customers and community in these weeks, with short and direct answers.
Since when is the Italian AI Act in effect?
Legislative Decree 179/2026 is in effect since October 23, 2026. It was published in the Official Gazette of October 7, 2026 and adapts Italian legislation to the European AI Act.
Who controls the use of artificial intelligence in Italy?
The supervisory and sanctioning powers are entrusted to AgID and ACN, coordinated by a single point of contact and a coordination committee.
Has the AI Act been postponed?
Only in part. The Digital Omnibus has moved the obligations on high-risk systems to December 2, 2027, and August 2, 2028. Bans and literacy on AI are already in effect since February 2, 2025.
Is consent required for tracking pixels in newsletters?
Yes, with the exception of statistics, security, or service communications. Consent can be collected together with consent for the newsletter, if the text of the opt-in explicitly mentions tracking.
What risks does someone who has not complied with the guidelines on tracking pixels run?
The deadline expired on October 29, 2026, and the Guarantor has included these checks in the inspection plan until December 2026. Anyone who uses pixels without information and consent may be subject to checks and measures.
What is PHP2Shell and how do I know if my site is vulnerable?
PHP2Shell is a pair of critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution. The site is at risk if the server uses a version of PHP earlier than 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Is WordPress at risk with PHP2Shell?
Yes, if the server on which it runs is not updated. The vulnerability is in PHP, not in WordPress: updating plugins and themes is not enough; you need to update PHP.