France shuts down prefecture websites before patches for two critical PHP flaws

On Wednesday, October 21, at around 2 p.m., the websites of the Drôme and Ardèche prefectures stopped responding, according to Actu17. During the afternoon, the same maintenance page appeared on the websites of other prefectures, including the Paris police prefecture. It was not an outage or an attack: it was a deliberate decision.

The Interior Ministry said it carried out, at the request of the Agence nationale de la sécurité des systèmes d'information (ANSSI), a "preventive maintenance shutdown of all its internet sites exposed to the vulnerability." The cause: the two PHP flaws announced the day before, whose leak ahead of the patch we covered. Prefectures were asked to communicate via social media and on-site notices.

Patches have been available since Wednesday afternoon

The PHP project released its fixes on October 21 at around 4 p.m. Paris time. The patched versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The two flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution, according to PHP. CERT-FR, the French government's computer emergency response team, updated its alert CERTFR-2026-ALE-014 the same day. It points out that all versions 8.1 and earlier, which are no longer maintained, are affected.

Should we fear a wave of intrusions? According to InformatiqueNews, Cloudflare observed exploitation attempts as early as October 21, without confirming that any succeeded. No compromise of prefecture sites linked to these flaws has been confirmed.

Part of the European web put on pause

France is not alone. According to media that followed the day's events, other sites were taken down for maintenance: part of the tax portal, Météo-France, the City of Paris, several banks, public agencies in the Netherlands and Finland, and the websites of the Flemish Region in Belgium. CERT-EU, the UK's NCSC and Australia's ACSC advised organizations unable to patch to take their sites offline. On the morning of October 22, several French public websites were still showing a maintenance page.

What to do on your servers?

The Interior Ministry's decision shows how serious the risk is: when the government prefers to shut down its sites rather than wait, the urgency is real. CERT-FR's recommendations:

• migrate to a maintained version that includes the latest security patches, now released;
• if updating is not possible right away, isolate the affected systems;
• in the meantime, two workarounds, not validated by CERT-FR: disable the session.upload_progress.enabled option in php.ini (this covers only one of the two flaws) and block requests whose Content-Type header is multipart, for example with a web application firewall, or otherwise monitor them closely;
• for PHP 8.1 and older versions, plan a migration to a maintained version.

Think about the servers that tend to be forgotten: old showcase sites, internal tools, contractors' extranets. The open question is what the coming days will bring: will the attempts spotted by Cloudflare turn into successful intrusions on servers left unpatched?