Pas php.net · Pas la NVD · Pas la CISA

Suivi des vulnérabilités PHP

Note d’information non officielle sur les vulnérabilités de sécurité PHP

English简体中文日本語DeutschFrançaisNederlandsEspañol

Alerte de sécurité

PHP2Shell : mettez PHP à jour. C’est le seul correctif complet.

CVE-2026-109618 et CVE-2026-109619 sont des failles critiques de PHP lui-même, permettant une exécution de code à distance sans authentification. Le projet PHP a publié des correctifs le 21 octobre 2026 pour les branches maintenues 8.2 à 8.5. Redémarrez PHP après la mise à jour. Un pare-feu ne la remplace pas.

Étapes de correction

Suivi des pannes

Pannes PHP2Shell : sites mis hors ligne et heure de retour

Portails publics, universités, plateformes et sites connus mis hors ligne les 21 et 22 octobre 2026, signalés en lien avec PHP2Shell. Figurer ici ne signifie pas une compromission : la plupart ont coupé par précaution ou pour maintenance.

Dernière mise à jour

53Sites suivis
9Toujours hors ligne
44Revenus
4h 47mDurée médiane

Par pays

  • Pays-Bas24
  • Mondial10
  • Japon5
  • Finlande3
  • Royaume-Uni3
  • Allemagne2
  • France2
  • Belgique2
  • Autriche1
  • Croatie1

Par type

  • Site24
  • Administration17
  • Plateforme9
  • Université3

🕒 Toutes les heures sont en UTC (24 h). La durée va du premier signalement hors ligne au premier signalement de retour.

Notre note
LIFULL HOME'SJaponPlateforme——Hors lignePublications X Real-estate portal reported offline on X in connection with PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a CDN error, which may reflect regional blocking. [Source]2026-10-22 08:35 · 403
at homeJaponPlateforme——Hors lignePublications X Real-estate portal reported in maintenance/offline on X, with posts linking it to PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a bot-check page, so it could not confirm the site's state. [Source]2026-10-22 08:41 · 405
SUUMOJaponPlateforme——Hors lignePublications X Real-estate portal reported offline on X in connection with PHP2Shell. The site shows its own system-maintenance page; the operator has not stated a cause. [Source]2026-10-22 08:35 · 503
D66 (Dutch political party)Pays-BasSite2h 47mRevenuPHPocalypse Tracker Political party site showed a temporary unavailability page for under three hours. [Source]2026-10-22 08:12 · 200
Nespresso Croatia online storeCroatieSite15mRevenuPHPocalypse Tracker Online store offline briefly for stated security maintenance. [Source]2026-10-22 08:12 · 200
Overheid.nl (Dutch government portal)Pays-BasAdministration12h 20mRevenuPHPocalypse Tracker Government portal offline for maintenance overnight; back the next morning (UTC). [Source]2026-10-22 08:12 · 200
French prefecture websitesFranceAdministration——Hors lignePHPocalypse Tracker Several prefecture sites show a shared maintenance page; others not checked. [Source]2026-10-22 08:12 · 200
Belgian Foreign AffairsBelgiqueAdministration7h 06mRevenuPHPocalypse Tracker Ministry site returned HTTP 503 in four languages; back after midnight (UTC). [Source]2026-10-22 08:12 · 302
City of Edinburgh CouncilRoyaume-UniAdministration5h 06mRevenuPHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about five hours. [Source]2026-10-22 08:12 · 200
Oxford City CouncilRoyaume-UniAdministration4h 06mRevenuPHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about four hours. [Source]2026-10-22 08:12 · 200
Bristol City CouncilRoyaume-UniAdministration1h 21mRevenuPHPocalypse Tracker Council site showed an unavailability notice for under two hours. [Source]2026-10-22 08:12 · 200
Port of RotterdamPays-BasSite2h 36mRevenuPHPocalypse Tracker Port authority site temporarily unreachable for under three hours. [Source]2026-10-22 08:12 · 301
KNVB (Dutch football association)Pays-BasSite1h 41mRevenuPHPocalypse Tracker Football association sites temporarily unreachable for under two hours. [Source]2026-10-22 08:12 · 200
PVV (Dutch political party)Pays-BasSite8h 36mRevenuPHPocalypse Tracker Political party site offline as a stated precaution until the next morning (UTC). [Source]2026-10-22 08:12 · 200
GroenLinks-PvdA (Dutch political party)Pays-BasSite1h 36mRevenuPHPocalypse Tracker Political party site offline for under two hours. [Source]2026-10-22 08:12 · 403
Acuity SchedulingMondialPlateforme3h 02mRevenuPHPocalypse Tracker Booking platform and login returned HTTP 503 for about three hours, then returned. [Source]2026-10-22 08:12 · 200
DriveThruRPGMondialSite7h 11mRevenuPHPocalypse Tracker Digital game store offline for maintenance for about seven hours. [Source]2026-10-22 08:12 · 403
Sakura Internet (domains and SSL)JaponPlateforme5h 46mRevenuPHPocalypse Tracker Domain and SSL control panel under emergency maintenance; notices do not name PHP; hosting and email unaffected. [Source]2026-10-22 08:12 · 200
EFRAG (European Financial Reporting Advisory Group)BelgiqueAdministration3h 08mRevenuPHPocalypse Tracker Site stopped connecting for about three hours, then returned. [Source]2026-10-22 08:12 · 301
DeviantArtMondialSite4h 32mRevenuPHPocalypse Tracker Art community suspended while applying a software update, then returned. [Source]2026-10-22 08:12 · 200
DigiDPays-BasAdministration5h 35mRevenuPHPocalypse Tracker Government login service offline for about six hours, then returned. [Source]2026-10-22 08:12 · 200
MijnOverheidPays-BasAdministration3h 35mRevenuPHPocalypse Tracker Government citizen portal offline for under four hours, then returned. [Source]2026-10-22 08:12 · 200
RTL NieuwsPays-BasSite3h 32mRevenuPHPocalypse Tracker News site offline for under four hours, then returned. [Source]2026-10-22 08:12 · 302
Follow the MoneyPays-BasSite2h 50mRevenuPHPocalypse Tracker Investigative news site offline for about three hours, then returned. [Source]2026-10-22 08:12 · 200
Platform InvesticoPays-BasSite1h 44mRevenuPHPocalypse Tracker Journalism platform offline for under two hours, then returned. [Source]2026-10-22 08:12 · 200
Nederlandse Orde van Advocaten (Dutch bar association)Pays-BasAdministration1h 44mRevenuPHPocalypse Tracker Bar association site offline for under two hours, then returned. [Source]2026-10-22 08:12 · 200
FC TwentePays-BasSite5h 50mRevenuPHPocalypse Tracker Football club site offline for about six hours, then returned. [Source]2026-10-22 08:12 · 301
Fortuna SittardPays-BasSite4h 05mRevenuPHPocalypse Tracker Football club site offline for about four hours, then returned. [Source]2026-10-22 08:12 · 301
Politievakbond ACP (police union)Pays-BasSite16h 34mRevenuPHPocalypse Tracker Police union site offline until the next morning (UTC). [Source]2026-10-22 08:12 · 301
KNMP (Dutch pharmacists' association)Pays-BasSite2h 20mRevenuPHPocalypse Tracker Pharmacists' association site offline for about two hours, then returned. [Source]2026-10-22 08:12 · 200
Scouting NederlandPays-BasSite1h 44mRevenuPHPocalypse Tracker Scouting association site offline for under two hours, then returned. [Source]2026-10-22 08:12 · 200
Kustwacht (Netherlands Coastguard)Pays-BasAdministration4h 35mRevenuPHPocalypse Tracker Coastguard site showed an unavailability page with emergency numbers; back later that day. [Source]2026-10-22 08:12 · 301
Security.NLPays-BasSite6h 05mRevenuPHPocalypse Tracker Security news site switched to maintenance mode, citing PHP2Shell as the reason. [Source]2026-10-22 08:12 · 200
easybillAllemagnePlateforme2h 20mRevenuPHPocalypse Tracker Invoicing web app offline (HTTP 503) as a stated precaution; vendor said data was safe. [Source]2026-10-22 08:12 · 302
Choice of GamesMondialSite2h 20mRevenuPHPocalypse Tracker Game publisher site showed a temporary 503 page, then returned. [Source]2026-10-22 08:12 · 200
CNIL (French data protection authority)FranceAdministration——Hors lignePHPocalypse Tracker Data protection authority site returns a maintenance page (HTTP 503) with no stated reason. [Source]2026-10-22 08:12 · 503
Tweede Kamer (Dutch parliament)Pays-BasAdministration8h 02mRevenuPHPocalypse Tracker Parliament website showed a maintenance notice; back the same evening. [Source]2026-10-22 08:12 · 200
NCSC (Dutch national cyber security centre)Pays-BasAdministration7h 02mRevenuPHPocalypse Tracker National cyber security centre site taken offline; back the same evening. [Source]2026-10-22 08:12 · 200
Autoriteit Persoonsgegevens (Dutch data protection authority)Pays-BasAdministration——Hors lignePHPocalypse Tracker Data protection authority site offline; no recovery recorded by the source. [Source]2026-10-22 08:12 · timeout
Valtori (Finnish central government web services)FinlandeAdministration18h 07mRevenuPHPocalypse Tracker Shared government web services offline; recovery recorded the next morning (UTC). [Source]2026-10-22 08:12 · timeout
National Land Survey of FinlandFinlandeAdministration——Hors lignePHPocalypse Tracker Land survey agency site shown as down; no recovery recorded by the source. [Source]2026-10-22 08:12 · 503
University of ViennaAutricheUniversité4h 17mRevenuPHPocalypse Tracker University website offline for a few hours, then returned. [Source]2026-10-22 08:12 · 200
University of FreiburgAllemagneUniversité21h 01mRevenuPHPocalypse Tracker Home page carried a computing-centre notice about the PHP flaws; the tracker saw the regular home page again on 22 Oct at 08:10 UTC. [Source]2026-10-22 08:24 · 301
Haaga-Helia University of Applied SciencesFinlandeUniversité——Hors lignePHPocalypse Tracker University website offline; no recovery recorded by the source. [Source]2026-10-22 08:12 · 301
TweakersPays-BasSite4h 59mRevenuPHPocalypse Tracker Tech news site offline for about five hours, then returned. [Source]2026-10-22 08:12 · 403
Fur AffinityMondialSite11h 47mRevenuPHPocalypse Tracker Art community offline until late evening (UTC). [Source]2026-10-22 08:12 · 403
PinboardMondialSite12h 02mRevenuPHPocalypse Tracker Bookmarking service offline until late evening (UTC). [Source]2026-10-22 08:12 · 200
Miraheze (all wikis)MondialPlateforme10h 02mRevenuPHPocalypse Tracker Wiki farm offline across all hosted wikis, then returned. [Source]2026-10-22 08:12 · 301
4chanMondialSite11h 47mRevenuPHPocalypse Tracker Imageboard offline until late evening (UTC). [Source]2026-10-22 08:12 · 302
NotuBiz council portalsPays-BasPlateforme——Hors lignePHPocalypse Tracker Council meeting portals run by NotuBiz went offline; reported in connection with PHP2Shell. [Source]2026-10-22 08:12 · 301
explain xkcdMondialSite9h 59mRevenuPHPocalypse Tracker Community wiki went offline for several hours, then returned. [Source]2026-10-22 08:12 · 301
Star Citizen WikiMondialSite4h 59mRevenuPHPocalypse Tracker Fan wiki taken offline for about five hours, then returned. [Source]2026-10-22 08:12 · 200
CodmonJaponPlateforme9h 41mRevenuPHPocalypse Tracker Childcare communication service stopped under emergency maintenance; restored by the evening (UTC). [Source]2026-10-22 08:12 · 200

« Notre vérif. » est une seule requête de statut HTTP par site, à l’heure indiquée : pas un scan, pas un test de vulnérabilité. Un 403 ou un délai dépassé peut signifier un blocage des requêtes automatisées.

Signaler un site passé hors ligne

Vous connaissez un site passé hors ligne en lien avec PHP2Shell, ou revenu en ligne ? Dites-le-nous. Chaque signalement est vérifié manuellement avant d’apparaître dans le tableau avec la mention « Signalement utilisateur (vérifié) ».

Questions

Ces sites ont-ils été piratés via PHP2Shell ?

Pas selon les sources. La plupart affichaient un avis de maintenance ou de précaution pendant la mise à jour de PHP.

D’où viennent les données ?

Du PHPocalypse Tracker (domaine public) ; chaque ligne renvoie à sa source d’origine.

Quel fuseau horaire ?

UTC. 17:05 UTC correspond à 19:05 à Paris (CEST).

Fréquence de mise à jour ?

Environ toutes les 10 minutes en journée, après vérification.