Why France Shut the Doors of Its Public Websites on Wednesday

Article written on the evening of October 21, 2026. The situation is changing by the hour: some details may be clarified in the coming days.

Imagine a town where almost every house has the same lock. A sturdy lock, fitted years ago, that nobody thinks about anymore.

One day, someone discovers it has a flaw. A clever burglar could open it without a key, walk in, go through the drawers, and even take control of the house as if they owned it.

And it was a robot that found the flaw. The robot wasn’t a burglar: it was helping researchers check the locks. But a burglar can ask a robot for help too.

The experts gave this danger a mark, like at school: 9.2 out of 10. That is almost top marks.

That is exactly what just happened on the Internet. The lock is called PHP. It protects around 7 in 10 websites worldwide. On Wednesday, October 21, as a precaution, France shut the doors of many public websites (the tax office, prefectures, Météo-France) while the locks were being changed. Some companies did the same.

In the coming days, you may come across a website that says “under maintenance.” It isn’t necessarily a breakdown: someone may simply be changing the lock.

A new lock already exists. But it has to be fitted house by house. And some houses are too old to ever get one.

So a simple question arises: who looks after the lock on your house?

For those who want the details, here is what happened.

What happened, in simple terms

In practice, on Wednesday, October 21, in the middle of the afternoon, the tax website, the Météo-France website and those of nearly all French prefectures became inaccessible. This was not an attack, but a precaution: at the request of ANSSI, France’s national cybersecurity agency, the Ministry of the Interior put its websites into “preventive maintenance.” Public websites in the Netherlands and Finland did the same. Some companies also cut part of their services: according to Actu17, Amsterdam Schiphol airport suspended its mobile app and Nintendo part of its services. In the United States, the federal cybersecurity agency called for an immediate update.

PHP is a programming language, in other words, a way of writing the instructions that make a website work. It’s unobtrusive but everywhere: it powers WordPress, Drupal, Joomla and Magento, tools used by countless businesses, nonprofit organizations and town halls. According to the researchers who discovered the vulnerabilities, PHP is used by around 70% of websites worldwide. Note that this figure refers to websites that use PHP, not those that are actually vulnerable. In France, ANSSI counted more than 600,000 servers running PHP, according to Le Figaro.

The two vulnerabilities, nicknamed “PHP2Shell,” allow what specialists call remote code execution: a malicious person can make a website’s server run their own instructions, without physical access or a password. Once inside, they can steal data, install hidden software or take over accounts linked to the site. The European Union’s Computer Emergency Response Team (CERT-EU) gives them a severity rating of 9.2 out of 10.

The timeline is worth telling. According to Wiz Research, the team that made the discovery, the first vulnerability was found on August 19 and reported to the PHP security team on August 24. The information was kept secret for two months while a fix was prepared. This is known as coordinated disclosure: first, you alert the people who can fix the problem; then you inform the public. But information leaked online before the planned date, speeding up the timeline. The fixes were released on Wednesday afternoon. According to Actu17, citing specialist media outlet The Record, they apply only to recent versions of PHP (8.2 and later); older versions are no longer maintained. Cloudflare’s chief technology officer, whose company protects a large part of the web, said he was seeing the first attack attempts.

The warning: the same AI opens and closes the doors

Wiz Research says it used several cutting-edge AI models to find the vulnerabilities and then verify the fixes. Actu17 reports that other researchers at Calif also worked with an OpenAI model. This is good news: AI helped detect a problem that had existed for years in a tool used everywhere.

But this is also at the heart of the ethical problem. The tool that finds a vulnerability so it can be fixed can also help exploit it. One expert interviewed by Le Figaro sums it up this way: “In the age of AI, we have to pray that things go well.” In the past, exploiting a vulnerability took time and rare skills. Today, that window is shrinking. Defenders, meanwhile, still have to update thousands of websites, one by one.

Three questions arise, without being alarmist:

• Who pays the price for speed? Large organizations have IT teams. Small business owners, neighborhood associations and village town halls often don’t. Their WordPress site, installed five years ago, may be running a version of PHP that will never be patched.
• Who maintains the foundations? PHP is free and open-source software, built and maintained by a community. Much of the web depends on this often-invisible work. Its security is a shared public good, like a road or a bridge.
• Who decides what gets published, and when? The premature leak of information left less time to protect systems. In a world where AI speeds everything up, restraint becomes a matter of public safety.

Hope: what each of us can do

This story also shows what works. Researchers found the vulnerabilities and reported them instead of selling them. A community worked for two months to fix them. Governments chose to take their websites offline for a few hours rather than expose citizens’ data. This is our guiding principle: build the city rather than the Tower of Babel. Build together, cautiously, rather than always reaching higher and moving faster.

You don’t need to be a computer expert to take action. Just ask the right people the right questions.

And if you use AI in your work, remember this lesson: a powerful tool is neither good nor bad in itself. It all depends on who uses it, for what purpose, and under what rules. This is also the subject of my book L'abondance tuera (in French): when power becomes abundant, wisdom becomes essential.

What about you?

Do you know who is responsible for the security of your website, your association’s website or your town’s website? And if an AI can find a vulnerability in just a few days, what should we expect from those who build and maintain our digital tools?

To make sure you don’t miss the next article, sign up for the Thursday newsletter on the Why allelu.ai page. And if you know a business owner, an association or an elected official who manages a website, forward this article to them: they may be the person who should read it first.

Sources

• Le Figaro, “Part of the global Internet brought to a halt after critical vulnerabilities discovered in PHP programming language,” October 21, 2026 (in French)
• Actu17, “Critical vulnerabilities in PHP: websites urgently taken offline around the world, including prefecture websites in France” (in French)
• Wiz Research, “PHP2Shell”
• CERT-EU, Security Advisory 2026-018
• CISA, “Critical Vulnerabilities in PHP Require Immediate Patching,” October 21, 2026

Written with the help of AI, reviewed and approved by Reynald Naulleau.