news
French prefecture websites taken offline after critical PHP security flaws found
Security experts warn the flaws could put websites at risk of cyberattacks
Published
Modified
Multiple French prefecture websites are currently down as a precaution after developers identified two critical security flaws in PHP, a programming language used by many websites.
Météo-France’s website and tax sites were also reported to be down during the disruption among other sites.
The French Interior Ministry said that the websites had been taken offline while security measures were put in place.
The PHP Foundation, which supports the development of the programming language, announced on X that two critical vulnerabilities had been identified.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
— The PHP Foundation (@ThePHPF) October 20, 2026
France’s national cybersecurity agency, ANSSI, warned that the vulnerabilities could allow attackers to execute code remotely on affected systems.
In an alert published on October 21, its cybersecurity response centre, CERT-FR, said the flaws affected several PHP versions, including versions 5, 6, 7 and earlier releases of version 8.
PHP is used by popular website management systems such as WordPress, Drupal, Joomla and Magento.
PHP developers released security fixes on Wednesday, October 21. CERT-FR recommends isolating affected systems and migrating to a supported PHP version with the latest security updates.
Similar measures have been taken by public organisations in the Netherlands and Finland.
The number of websites affected worldwide and how long French prefecture websites will remain offline have not been confirmed.
