Particle.news
Get it on Google Play
Download on the App Store
7 ARTICLES
·
4h ago

French Authorities Take Institutional Sites Offline After Critical PHP Flaw

Available patches offer a path to fix the flaw for sites that can update, leaving older and shared‑hosted systems exposed longer

[Imen Ben Youssef / Hans Lucas / Hans Lucas via AFP]
Plusieurs sites internet français, dont ceux de ministères, préfectures et grands médias, sont inaccessibles afin de corriger des failles de sécurité situées dans un protocole de programmation très utilisé sur internet
Image
Image

Overview

  • On Wednesday the national cyber agency ANSSI asked the Interior Ministry to put exposed sites, including all préfectures and the Paris police préfecture, into preventive maintenance to avoid unauthenticated remote code execution.
  • The PHP project and CERT‑EU published security updates on October 21st with patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and urged immediate upgrades.
  • Authorities and hosting teams are mobilized to apply fixes but sites running unsupported PHP releases or hosted on shared/mutualized services may take much longer to remediate and remain vulnerable.
  • Many affected public services redirected communications to social media and physical notices while teams work, and some national and international sites including municipal and media pages were temporarily taken offline.
  • Because PHP runs on roughly three quarters of websites and about 43% use WordPress, experts say the flaw widens the attack surface and recommend isolating affected systems and migrating to maintained PHP versions.