PHP vulnerabilities remain a serious threat

A significant number of websites using the PHP programming language are still vulnerable to critical security flaws, despite patches being available for weeks. At least 250,000 .fr domains—French website addresses—have been found to be running outdated PHP versions that expose them to potential exploitation.

Critical vulnerabilities revealed in October

On October 21, the PHP development team disclosed two major security flaws that allow attackers to run arbitrary code remotely. These vulnerabilities are serious, but patches are available to fix them. Some websites, including Next, have temporarily shut down to apply updates and prevent potential breaches.

A new vulnerability emerges

A third vulnerability, named CVE-2026-115560, has since been identified. It also allows remote code execution, though the conditions for exploitation are rare. A patch is expected to be released with the next PHP update cycle, according to the CERT-FR, a French cybersecurity agency.

Urgent call to action from U.S. authorities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the two PHP vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which lists flaws that are already being actively exploited. This action pressures federal agencies and private organizations to update their systems promptly.

Exploits already in the wild

CERT-FR has confirmed that attackers are actively trying to exploit the PHP vulnerabilities. The affected versions range from PHP 5.4 (released in 2012) to PHP 8.5. Only the newer versions have received updates, leaving many systems exposed.

Real-world attacks reported

Cybersecurity firm Palo Alto Networks reported that the PHP2Shell vulnerabilities are being used to attack internet-facing management systems. Researchers from Dream Research also found evidence of a campaign that combined PHP2Shell with a Linux kernel exploit to gain full control of 25 servers, some linked to U.S. government systems.

French websites show widespread exposure

An analysis of .fr domains revealed that nearly 500,000 French websites are running PHP versions that could be vulnerable. This number is based on HTTP responses that included PHP version data, though many other sites may still be at risk without proper updates.