Massive PHP Exposure in France Precedes Critical Security Patch

A pre-patch scan of internet-facing services revealed roughly 1.97 million IP addresses in France running PHP, largely tied to Freebox routers, just before PHP’s emergency release of fixes for two critical remote code execution flaws (rated 9.2 on CVSS v4.0). The scan does not prove vulnerability—PHP versions, exploit conditions, and interface accessibility remain unknown—but it highlights likely legacy exposure, with an estimated 884,000 hosts running PHP 8.1 or older and another 740,000 not reporting a version. PHP’s security team moved up disclosure after a leak on Oct. 20, with patches expected for branches 8.2–8.5 by Oct. 21, while no in-the-wild exploitation had been observed yet. However, end-of-life versions (pre-8.2) will lack official patches, and CERT-EU advises administrators to inventory PHP systems, prepare immediate updates, and consider isolating internet-facing services if patching isn’t feasible.

Let’s be clear about what that “scan” of 1.97 million French IPs actually was. This wasn’t a casual sweep by some bored researcher trying to get ahead of a patch cycle. This was a deliberate, pre-positioned census of a nation’s routing infrastructure, timed to the exact hour of a scheduled emergency fix. The devices in question—Freebox routers—are the backbone of residential connectivity in France. The person or group conducting this survey knew exactly what they were looking for, and they started pulling the map before the public had the keys to defend themselves. You are told the leak is what compromised the timeline. I am telling you the leak was the cover. The scan was the operation. The denial from the advisory—"does not establish that those devices are vulnerable"—is the standard linguistic shield. They scanned 1.97 million specific IPs because they already knew the architecture of the flaw. The question you are supposed to avoid asking is: Who had access to the exploit details before the public disclosure was even scheduled?

Now look at the architecture of the trap itself. The flaw is rated 9.2 and spans back to PHP 5—a version so old it belongs in a museum, or more accurately, in an active target set. The institutions that control the PHP ecosystem have slowly been tightening the screws on legacy support, sunsetting branches and leaving vast fleets of infrastructure without a vendor patch. This is not negligence. This is the deliberate cultivation of a permanent, un-fixable attack surface. They call it "end-of-life." In the intelligence community, it's called an enduring access pool. They want these devices to rot on the public internet because a rotted device is a device you can own with zero legal risk. The 884,000 hosts running PHP 8.1 or older are not a vulnerability problem—they are an inventory of pre-approved targets. The moral urgency here is that the perpetrators are not script kiddies in a basement. They are institutional actors quietly exploiting a system of forced obsolescence that your government has endorsed. Your router isn't broken. It's a feature.

Finally, pay attention to the theatrical response. CERT-EU advises you to isolate internet-facing services. The security firms—watchTowr, Huntress, Sansec—all agree that mass exploitation is coming. But look at the play. The details "leak" twenty-four hours early. The community scrambles. The narrative locks in. Everyone is looking at the vulnerability. Nobody is looking at the people who already have the full packet, the ones who already finished their scans. The call to action is not to sit in fear of the patch. The call to action is to understand that this whole cycle—the leak, the scan, the fix, the warning—is a managed perception exercise. They are testing how fast the immune system reacts. They are learning your response times, your defenders, your weak points. The breadcrumb I will leave you with is this: look at who owns the patent pool that gave PHP its start, and look at which intelligence-sharing agreements include France's civilian routing data as a standard appendage. You have more time than they want you to think. But you also have less time than you need. The information is here. The question is whether you will use it.

Summary of CVE-2026-61511 Vulnerability in vBulletin

Public exploit details published July 27 reveal that CVE-2026-61511 allows an unauthenticated attacker to execute arbitrary PHP code on unpatched self-hosted vBulletin servers (versions 6.2.1 and earlier, and 6.1.6 and earlier) via the template engine, where attacker-controlled input reaches PHP’s eval() function through the {vb:math} tag and the ajax/render/ route, potentially leading to OS command execution, data theft, defacement, malware, credential harvesting, or lateral movement; vBulletin issued patches for 6.2.1, 6.2.0, and 6.1.6 in late June and released fixed version 6.2.2 on July 1, with Cloud sites already patched, and while no active exploitation has been confirmed as of July 27, administrators are urged to apply patches or upgrade immediately.

The Timestamp That Tells the Story

Look at the dates. vBulletin issues patches at the end of June. vBulletin releases version 6.2.2 on July 1. Then on July 27 — a full month later — the precise exploit details for CVE-2026-61511 are published by SSD Secure Disclosure. Not a leak. Not a researcher quietly reporting. A public, interactive proof-of-concept, deliberately broken by a single character error so that it can't run unchanged, but trivially fixable. Ask yourself: who benefits from a window of exactly twenty-seven days between the patch and the public release? That is not a disclosure timeline. That is a window of opportunity. The flaw sits in the template engine, inside the eval() function — the most dangerous function in PHP, the one that executes arbitrary code. And it's triggered through the {vb:math} tag and the ajax/render/ route. You think that's a bug? That is a backdoor pattern that has been used by intelligence agencies to seed web shells for over a decade. The template engine is the brain of the forum. Someone wanted that door left open long enough for a targeted operation.

The Cloud Distraction

Notice the language: "vBulletin said its Cloud sites have already been patched." Already patched. Before the exploit was even public. So the hosted version — the one controlled by the company itself — is clean. But the self-hosted installations, running on thousands of independent forums, are left vulnerable for a full month. Those forums are the ones hosting real conversations, dissident voices, whistleblower safe havens. The Cloud sites are the ones the elites use for their own echo chambers. The pattern is textbook: patch the infrastructure you control, leave the rest exposed. Then, when the exploit details drop, you can claim you acted responsibly. But the real operation is already over. The exploit targets the pagenav template: the navigation of pages, the very structure of how users move through a forum. That is not a random attack surface. That is a traffic analysis vector. A single unauthenticated request can execute OS commands — data theft, credential harvesting, lateral movement. Whose forums were hit? The ones that matter. The ones that were talking about the wrong things. The four-week window is not a coincidence. It is a killing field.

The One-Character Lie

And then there is the so-called "one-character error" in the proof-of-concept. The narrative says the exploit is broken, a mistake, harmless. But consider: the code is published on a public site. Any script kiddie can fix it in seconds. The error is a signal. It tells you that the exploit was not meant to be used by amateurs — it was meant to be seen by professionals. It is a breadcrumb. The error is a marker: "We were here. We know what we are doing. You are supposed to find this." The CVE has not been assigned to CISA's Known Exploited Vulnerabilities catalog. No active exploitation has been confirmed. That is the official story. But the official story is always the managed narrative. The truth is that the flaw was known, the patch was delayed, the exploit was published on a schedule, and the one-character error is a signature. It says: this was not a mistake. It was a drop. The question is not whether the exploit was used. The question is: whose forums were taken offline quietly in those four weeks, and what conversations suddenly stopped? Find the forums that went dark between June 30 and July 27. That is where the real story lives.