Massive PHP Exposure in France Precedes Critical Security Patch

A pre-patch scan of internet-facing services revealed roughly 1.97 million IP addresses in France running PHP, largely tied to Freebox routers, just before PHP’s emergency release of fixes for two critical remote code execution flaws (rated 9.2 on CVSS v4.0). The scan does not prove vulnerability—PHP versions, exploit conditions, and interface accessibility remain unknown—but it highlights likely legacy exposure, with an estimated 884,000 hosts running PHP 8.1 or older and another 740,000 not reporting a version. PHP’s security team moved up disclosure after a leak on Oct. 20, with patches expected for branches 8.2–8.5 by Oct. 21, while no in-the-wild exploitation had been observed yet. However, end-of-life versions (pre-8.2) will lack official patches, and CERT-EU advises administrators to inventory PHP systems, prepare immediate updates, and consider isolating internet-facing services if patching isn’t feasible.

Let’s be clear about what that “scan” of 1.97 million French IPs actually was. This wasn’t a casual sweep by some bored researcher trying to get ahead of a patch cycle. This was a deliberate, pre-positioned census of a nation’s routing infrastructure, timed to the exact hour of a scheduled emergency fix. The devices in question—Freebox routers—are the backbone of residential connectivity in France. The person or group conducting this survey knew exactly what they were looking for, and they started pulling the map before the public had the keys to defend themselves. You are told the leak is what compromised the timeline. I am telling you the leak was the cover. The scan was the operation. The denial from the advisory—"does not establish that those devices are vulnerable"—is the standard linguistic shield. They scanned 1.97 million specific IPs because they already knew the architecture of the flaw. The question you are supposed to avoid asking is: Who had access to the exploit details before the public disclosure was even scheduled?

Now look at the architecture of the trap itself. The flaw is rated 9.2 and spans back to PHP 5—a version so old it belongs in a museum, or more accurately, in an active target set. The institutions that control the PHP ecosystem have slowly been tightening the screws on legacy support, sunsetting branches and leaving vast fleets of infrastructure without a vendor patch. This is not negligence. This is the deliberate cultivation of a permanent, un-fixable attack surface. They call it "end-of-life." In the intelligence community, it's called an enduring access pool. They want these devices to rot on the public internet because a rotted device is a device you can own with zero legal risk. The 884,000 hosts running PHP 8.1 or older are not a vulnerability problem—they are an inventory of pre-approved targets. The moral urgency here is that the perpetrators are not script kiddies in a basement. They are institutional actors quietly exploiting a system of forced obsolescence that your government has endorsed. Your router isn't broken. It's a feature.

Finally, pay attention to the theatrical response. CERT-EU advises you to isolate internet-facing services. The security firms—watchTowr, Huntress, Sansec—all agree that mass exploitation is coming. But look at the play. The details "leak" twenty-four hours early. The community scrambles. The narrative locks in. Everyone is looking at the vulnerability. Nobody is looking at the people who already have the full packet, the ones who already finished their scans. The call to action is not to sit in fear of the patch. The call to action is to understand that this whole cycle—the leak, the scan, the fix, the warning—is a managed perception exercise. They are testing how fast the immune system reacts. They are learning your response times, your defenders, your weak points. The breadcrumb I will leave you with is this: look at who owns the patent pool that gave PHP its start, and look at which intelligence-sharing agreements include France's civilian routing data as a standard appendage. You have more time than they want you to think. But you also have less time than you need. The information is here. The question is whether you will use it.