# Source: Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Cryptoast: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?

**Cryptoast** · [https://cryptoast.fr/failles-critiques-php-php2shell-france-freebox-que-faire/](https://cryptoast.fr/failles-critiques-php-php2shell-france-freebox-que-faire/) · published 2026-10-21T10:19:06+00:00 · added by `curator@php.newsroom` · slug `cryptoast-failles-critiques-php-php2shell-france-f`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cryptoast (French), 21 October: two critical flaws threaten PHP servers; France appears especially exposed, notably because of Freebox devices. A firs...

## What it says, as the collector read it

#### Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/cryptoast/failles-critiques-php-php2shell-france-freebox-que-faire`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Cryptoast (French), 21 October: two critical flaws threaten PHP servers; France appears especially exposed, notably because of Freebox devices. A first report placed France first among exposed countries with 60% of detected services worldwide, but the page says that figure was largely inflated by an error concerning the Freebox and must be put in perspective. It also asks what the real risks are and how to protect oneself. The page suggests readers check their exposure with the Infrawatch site or by asking an LLM such as Claude or ChatGPT; that is advice to human readers, noted as material and not acted on.

> Mais ce chiffre, largement gonflé par une erreur concernant les Freebox, doit être relativisé.

_Curator's translation:_ "But this figure, largely inflated by an error concerning the Freeboxes, has to be put in perspective."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Cryptoast reports an Infrawatch study putting 6.62 million of 11 million detected PHP services worldwide in France (about 60%), mostly because of Freebox OS devices. It cautions that this does not mean French sites are vulnerable. A reader comment cites Numerama saying Freeboxes are not affected.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?". Selected mechanically, not read by a person.

#### Capture notes

Language `en`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://cryptoast.fr/failles-critiques-php-php2shell-france-freebox-que-faire/- `headers.json` 25cb83b8ab727a96e40ce9ac342ba0f8fd04868a7cbee2ac9b794ca4972f0567 1,490 bytes
- `page.html` fbb4869ec546b9c3f7705381453c0902c483263b6eff5f333e7db1c3cc32df82 507,386 bytes
- `provenance.json` b85e75f594ea82e06740d17bee3855347b33158ca7ab63c119bbd0fa734d877d 1,625 bytes
- `text.txt` 3555725ce40f48f75a5a97724389f85fcf69111a1417820913ceef24fd463208 8,472 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.18.2 · data as of 2026-10-24T16:05Z · vault commit 8c16a64a7cf6 · https://php.oct.2026.newsroom.sgit.ai/sources/cryptoast-failles-critiques-php-php2shell-france-f/index.html