Critical PHP flaws: France's cybersecurity agency has prefecture sites shut down and urges others to follow

On the morning of Thursday, October 22, the website of the Nord prefecture still displays “Maintenance in progress,” as does the Rhône prefecture's. Since the day before, the Interior Ministry has taken down its sites exposed to two critical PHP flaws. PHP is the language that powers WordPress, Drupal, Magento and a good share of the web. “At the request of the Agence nationale de la sécurité des systèmes d'information (ANSSI, France's national cybersecurity agency), the Interior Ministry has placed all its websites exposed to a critical security vulnerability into preventive maintenance,” it said. This is not an attack, but a precaution.

ANSSI advises everyone to do the same. In a message issued with CERT-FR (the French government's computer emergency response team), it recommends taking affected servers offline where possible until the update is applied, citing the risk of denial of service, data theft, takeover of the information system and business interruption. The two flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 (CVSS v4). Their details had leaked before the patch: PHP moved its release up by one day, and versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 came out on Wednesday, October 21, at around 4 p.m. Paris time.

All web installations of PHP are affected

According to PHP, these flaws could let an unauthenticated attacker run code on the server. The first stems from how PHP handles running out of memory: PHP can be interrupted while the request data is only half initialized, and the cleanup that follows treats it as valid. The second lets a request's internal state survive after its memory is freed: the next request handled by the same process can reuse it. The defect is in PHP itself, so a site with flawless code remains vulnerable.

PHP lists all installations that serve web pages: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, the Apache module: a single unauthenticated request is enough to trigger the attack before the application code even runs. ANSSI considers the situation particularly critical for transactional sites, those handling sensitive data and those connected to internal systems.

Old PHP versions will get no new official release

The CERT-FR alert (CERTFR-2026-ALE-014) lists as affected all 5.x, 6.x, 7.x, 8.0 and 8.1 versions, which are no longer maintained. For these, it recommends isolating the servers, then migrating to a supported version. PHP has nonetheless published minimal patches, as source code, for the 7.4, 8.0 and 8.1 branches. Linux distributions and extended-support vendors received the fixes in advance: that is where to look for updated packages.

What to do if the update has to wait?

The prefectures chose to shut down rather than gamble on a workaround, and PHP agrees: only the update truly protects you. If you can neither update nor shut down, CERT-FR suggests two measures, which it has not validated itself:

• Disable file upload tracking: session.upload_progress.enabled = Off in php.ini, and php_admin_flag[session.upload_progress.enabled] = off in PHP-FPM pools, then restart the processes. This reduces the risk for only one of the two flaws.
• Block multipart HTTP requests (those from forms with file uploads) on the web application firewall, or at least monitor them closely.
• Look for traces since October 17: Amazon says it saw a first attempt that day on its honeypot servers, four days before publication. Amazon advises looking for POST requests containing PHP_SESSION_UPLOAD_PROGRESS, and Huntress for PHP processes that launch a shell, curl or wget. According to The Hacker News, memory limit errors or strings of 500 responses, abnormally long session cookies and unexplained restarts of PHP processes should also raise alarms.

Attack attempts, but no confirmed intrusion yet

On October 21, watchTowr said it observed exploitation attempts against both flaws, and Cloudflare reported “first attacks.” Amazon now believes the flaws are widely exploited, though it does not know whether the attempts it observed would have succeeded on real servers. On the morning of October 22, neither appears in CISA's catalog of exploited vulnerabilities. France is not alone in shutting down: in the Netherlands, DigiD, MijnOverheid and the national cybersecurity center itself were taken offline. This Thursday morning, impots.gouv.fr and the website of the CNIL (the French data protection authority) still display a maintenance page. It remains to be seen when these sites will reopen, and how many small servers running forgotten versions will stay online without a patch.