Failles PHP2Shell : on a scanné tout le .fr, 250 000 sites affichent un PHP vulnérable - Next

Failles PHP2Shell : on a scanné tout le .fr, 250 000 sites affichent un PHP vulnérable - Next

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page fr/news/next/264756-failles-php2shell-on-a-scanne-tout-le-fr-250-000-site, snapshot 20261103T071521Z. Copied byte for byte; every file's sha256 is in captures/20261103T071521Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A French tech-news report (Next, 2 November) in which the outlet scanned the .fr domain space after the disclosure. Working from the AFNIC open-data list of the 4.6 million .fr domains that still existed in September 2026, it found about 1.2 million with no HTTP status, about 2.6 million answering without a PHP version (PHP may still be installed), and about 500,000 responses carrying a PHP version, of which at least 250,000 domains announce a vulnerable version. It recalls CISA's KEV listing a week after disclosure, CERT-FR's note of exploitation attempts against specific PHP deployments, the third flaw CVE-2026-115560 (which CERT-FR says needs an unlikely combination of options and will be fixed in the next cycle), Palo Alto Unit 42's statement on PAN-OS management interfaces and Dream Research's report of a campaign that rooted 25 servers including US government-affiliated systems. It stresses that exploitation is complex and the risk to ordinary users is limited.

> Nous avons identifié au moins 250 000 domaines en .fr qui annoncent une version de PHP vulnérable.

_Curator's translation:_ "We have identified at least 250,000 .fr domains that announce a vulnerable PHP version."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Failles PHP2Shell : on a scanné tout le .fr, 250 000 sites affichent un PHP vulnérable - Next". Selected mechanically, not read by a person.

Capture notes

Language fr-FR. The scan is the outlet's own, by version banner, with the usual caveat that distributions backport fixes without changing the version number. The page is followed by reader comments, which are not recorded (they include unverified claims about backports). Nothing in the page addresses an AI or hides text from a reader.