Critical flaws in PHP: why government websites were taken offline
Part of the world’s online services was disrupted after the disclosure of critical vulnerabilities in PHP, a language widely used to run websites. In France, many public sites, including those of several prefectures, became temporarily unreachable. Europe and the United States also took precautionary measures.
This article will also interest you: Microsoft fixes 17 critical flaws during Tuesday patch
Prefecture websites offline: preventive maintenance
Reports about French government websites rose sharply on DownDetector shortly after 3 p.m. on Wednesday, October 21. According to checks relayed by the press, the tax website, the Paris police prefecture site, Météo France and nearly all prefecture websites were affected.
The Ministry of the Interior confirmed preventive maintenance of the sites exposed to a critical vulnerability, at the request of ANSSI. The decision shows how serious the flaw was judged to be: rather than leave services exposed, the authorities preferred to take them offline temporarily while the fixes were applied.
An alert that crosses borders
The phenomenon is not limited to France. In the Netherlands, Parliament, the national cybersecurity agency and Finland’s central administration also took websites offline as a precaution. In the United States, the NSA recommended an immediate update of many sites, stressing that the language involved had vulnerabilities that could open direct access to a server’s file system or database.
PHP flaw and remote code execution
Developers at the PHP Foundation announced two critical vulnerabilities. They kept the information confidential for about two months in order to prepare a fix, then urged users to update their installations as soon as possible. The notice published on PHP.net and the CERT-FR bulletin, which tracks them as CVE-2026-109618 and CVE-2026-109619, describe the same issue: remote code execution.
For Guillaume Vassault-Houlière, founder of YesWeHack, the flaw is especially serious because PHP is so widely deployed. It allows remote code execution in particular: an attacker can run code on a server without physical access. Once the breach is exploited, that person can take control of the system, steal data, install malware or recover accounts linked to the compromised site.
Up to 70% of French websites exposed?
ANSSI said that more than 600,000 servers were running PHP on the French Internet. A cybersecurity expert quoted by Le Figaro estimated that about 70% of French websites could be exposed. The figure shows the scale of the risk: PHP powers many content management systems, including WordPress, Drupal, Joomla and Magento. Every version since PHP 5, released in 2004, could be affected.
PHP update: the fix is available
The fix can now be downloaded. For IT managers, the task is to apply the update quickly across every affected server. CERT-FR lists the corrected versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions are no longer updated by the PHP project, so the vendor’s fix is required, or a move to a version that is still maintained.
Early exploitation attempts were observed by Cloudflare. Its chief technology officer, Dane Knecht, described emerging attacks on X and protections adapted as the vectors evolved.
Taking a site offline is not always required in order to install the fix, but it reduces exposure during the operation. ANSSI recommended shutting down the affected servers until the update was applied. Government websites took that precaution. For commercial companies the decision is harder, because an outage has a cost. Waiting can leave them more exposed.
AI and cybersecurity: a higher risk
The attack method circulated before every organization could patch. With AI, an attacker can more easily turn a set of instructions into an automated exploitation attempt. Experts therefore stress speed: identify the affected servers, test backups, apply the fixes and watch for signs of intrusion.
FAQ
What is PHP?
PHP is a programming language widely used to build websites and applications. It runs content management systems such as WordPress, Drupal, Joomla and Magento.
Why were websites taken offline?
Authorities chose preventive maintenance so that a vulnerable site would not be exploited before the fix was applied.
Is going offline mandatory?
No, but it reduces the risk while the fix is installed. ANSSI recommended shutting down the affected servers until the update.
What can the critical flaws allow?
They can allow remote code execution, takeover of a server, data theft or the installation of malware.
What should companies do?
Inventory PHP servers, apply the fix, check backups, monitor logs and strengthen intrusion detection.
Key takeaways
- Two critical flaws in PHP led, on October 21, 2026, to preventive takedowns, including many prefecture websites in France.
- ANSSI requested that maintenance. More than 600,000 PHP servers are counted on the French Internet.
- The fix is available. It needs to be applied quickly, backups need to be tested, and intrusions need to be watched.
- The sources to follow are the CERT-FR alert, the PHP Foundation and the update published by Cloudflare.
Taking a site offline is not the goal. It is time bought to install the PHP update before an exploitation attempt succeeds.
