The PHP Freebox vulnerabilities do not prove that nearly two million boxes are vulnerable. The figure of 1.97 million corresponds to French IP hosts classified as using PHP, not households or hackable devices. As of October 21, 2026, two PHP vulnerabilities rated 9.2 out of 10 had been confirmed, but the affected components and exploitation conditions had yet to be published.
Are Freeboxes actually affected by the PHP vulnerabilities?
As of October 21, 2026, there was no basis for claiming that the two critical PHP vulnerabilities affected Freebox OS. The official announcement from the PHP project specified neither the vulnerable components, the affected versions, nor the exploitation prerequisites. The connection to Freeboxes was based mainly on automated detection results.
PHP is a server-side language: among other things, it generates web pages from a program processed on the machine hosting the service. However, an address ending in “.php” does not prove that a PHP interpreter—that is, the software that executes this language—is operating behind the interface.
On October 21, 2026, Frandroid stated, according to its own information, that Freebox OS did not run a PHP server. The template files would porter a “.php” extension, but would be processed by software developed by Free. This explanation makes a false positive plausible, without constituting primary confirmation from the operator, since no public statement by Free to that effect had been found in the sources reviewed.
The trap is a familiar one: a scanner identifies a technical clue, and that clue then improperly becomes proof of a vulnerability. The same problem exists with many Internet-exposed connected devices : visibility, identification du logiciel et possibilité d’attaque sont trois constats distincts.
What does the figure of 1.97 million hosts really mean?
The figure of 1.97 million refers to IP hosts observed in France and classified as using PHP, according to Infrawatch data relayed on October 21, 2026. This total does not correspond to 1.97 million confirmed Freeboxes, 1.97 million distinct households, or as many exploitable systems.
Over a 48-hour period, the figures relayed indicated approximately 4.3 to 4.38 million hosts observed worldwide, including 1.97 million in France. They also mentioned 11 million observations of services or ports, including 6.62 million in France. A single host can expose multiple services; therefore, adding these observations as though they were unique devices distorts the analysis.
| Signal observed | What it establishes | What it does not establish |
|---|---|---|
| URL or file ending in “.php” | A visible naming convention | The presence of an active PHP interpreter |
| 1.97 million French IP hosts | Hosts classified as using PHP | Two million vulnerable Freeboxes or households |
| 6.62 million services or ports in France | Observations of network services | 6.62 million distinct devices |
| Two CVSS v4.0 scores of 9.2 | Potential critical severity | Possible exploitation on every detected interface |
Frandroid also estimated, in an analysis published on October 21, 2026, that removing the false positives attributed to Free and Iliad would bring the French total down to around 250,000 services, compared with 786,283 in the United States. This calculation remains single-source information. It should not be treated as an official or definitive count.
An exposure measurement answers the question “what appears to be accessible?” A vulnerability analysis then verifies the software actually running, its version, its configuration, and the conditions required for an attack. Confusing the two can trigger a costly emergency response where a brief technical check would have been sufficient.
What was known about the two critical PHP vulnerabilities?
The PHP Security Team announced two critical vulnerabilities on October 20, 2026, each rated 9.2 out of 10 under the CVSS v4.0 framework. The correctifs were scheduled for October 21 at 2 p.m. UTC, or 4 p.m. in metropolitan France, but the technical details had deliberately been reserved for the final advisories.
The advance announcement did not name the affected components, vulnerable branches, corriged versions, or exploitation conditions. It was intended to allow administrators to prepare a rapid update. Publications mentioned the identifiers CVE-2026-109618 and CVE-2026-109619, as well as unauthenticated remote code execution, but these elements did not appear in the PHP project's initial announcement.
Patchstack stated on October 21, 2026, that hosting partners had reported active exploitation beginning at 7:34 a.m. UTC. However, the sources reviewed provided neither independent technical confirmation nor the exact scope of the affected versions. To decide on a business action, a signal reported by a security organization deserves attention, but it does not replace the official advisory or the hosting provider's advisory.
The officially supported branches on October 21, 2026, were PHP 8.2, 8.3, 8.4, and 8.5. According to PHP documentation, branch 8.2 was scheduled to receive security correctifs through December 31, 2026; older branches had reached end of life. The latest security versions released before the October alert were PHP 8.2.34, 8.3.35, 8.4.26, and 8.5.11, dated September 24, 2026.
What should a Freebox subscriber do as a precaution?
A Freebox subscriber should check whether remote administration is necessary, disable it worhen it is not needed, use a strong administrator password, and keep the box firmware up to date. These measures reduce general exposure in 2026, but they do not prove that the announced PHP vulnerabilities affect Freebox OS.
La documentation de Free confirme que l’administration distante de Freebox OS peut être activée dans « Gestion des accès ». L’interface utilise une authentification par mot de passe et peut être rendue accessible au moyen d’une adresse IP ou d’un domain name associé à un port configuré.
The useful checks are limited and practical:
- disable remote access if you never administer the Freebox oortside your home or business premises;
- replace a short, reused, or shared password with a unique administrator password;
- install firmware updates offered by Free;
- check the access settings rather than relying on the presence of an address containing “.php”;
- wait for an official statement from Free before attributing an incident to the October 2026 PHP vulnerabilities.
Resetting the box or changing the entire network configuration without evidence of compromise is not the recormended response. Honestly, it is better to eliminate unnecessary remote exposure than to multiply actions that could interrupt the company's connection. To go further, a few free cybersecurity tools can also help structure basic checks without replacing an audit.
How do you check a site or application that uses PHP?
Un administrateur d’un service PHP doit inventorier les versions exécutées sur les servers web, les pools PHP-FPM, les conteneurs et les tâches en ligne de commande. Il doit ensuite repérer les services accessibles depuis Internet, appliquer la version corrigée officielle ou fournie par l’hébergeur, redémarrer les processus concernés et contrôler la version réellement active.
PHP-FPM is a process manager that runs PHP for a web server such as Nginx. A container, for example one using Docker, isolates an application with its dependencies. These two layers create a common risk: updating the server package is not enough if an old container image or a process that has not been restarted continues running.
In the projects we work on, we often see several PHP versions coexisting: one for the public site, another for a scheduled task, and sometimes a third in an old container. The inventory must therefore forcus on active processes, not just the version displayed in the hosting panel.
The correctif may come directly from the PHP project or be integrated by a provider such as OVHcloud, a Linux distribution, or a managed platform. The right approach is to follow the provider's channel—the one actually maintaining the package. A version whose number appears old may, in some cases, include a backported correctif; only the provider's advisory can confirm this.
After the update, verify the version loaded by the web server and restart the affected PHP-FPM pools, containers, and persistent tasks. Then test the application's essential workflows. A perimeter protection service such as Cloudflare may filter certain requests, but it does not replace correction of the vulnerable component, just as protection against DDoS attacks does not corrige an application vulnerability.
How can you make a decision without giving in to premature alarm?
The right decision is to distinguish four levels: visible service, confirmed technology, vulnerable version, and technically possible exploitation. For the PHP vulnerabilities in October 2026, the urgency concerned administrators of confirmed PHP services. Freebox subscribers should reduce unnecessary access without considering their equipment compromised based solely on a scan.
On the agency side, the best practice is to keep a record of the version before and after correction, the package source, and the tests performed. This discipline facilitates discussions with the hosting provider, prevents the incident from being declared closed too quickly, and provides usable information if an anomaly subsequently appears.
An editorial and technical update remains necessary after the PHP Security Team publishes its final advisories. It must record the confirmed CVE identifiers, the affected and corrigées versions, the exploitation prerequisites, and any vendor advisories. Without this information, assigning a precise risk to a Freebox or a specific site would be speculative.
Defining the exposure, software inventory, and correction procedure before an alert prevents most rushed decisions. An outside perspective can especially help distinguish media attention from a demonstrated risk, then focus the budget and downtime on the services actually concerned.
FAQ about PHP vulnerabilities and Freebox
Does an address ending in .php prove that the server uses PHP?
An address ending in “.php” does not prove that a PHP interpreter is running on the server. The name may be retained for compatibility reasons or processed by other software.
Does a CVSS score of 9.2 mean that an attack has already succeeded?
A CVSS v4.0 score of 9.2 indicates potential critical severity, not a confirmed compromise. The presence of the affected component, its version, configuration, and exploitation conditions must also be verified.
Should remote administration of Freebox OS be disabled?
Remote administration of Freebox OS should be disabled when it is not in use. When it is necessary, a unique, strong password and up-to-date firmware reduce overall exposure.
How can you find out which version of PHP is actually running on a website?
The actual PHP version must be checked in the process serving the site, the PHP-FPM pool, or the active container. The version displayed by a hosting panel or command line may differ from the version being executed by the application.