{"id":114245,"date":"2026-10-22T15:12:40","date_gmt":"2026-10-22T13:12:40","guid":{"rendered":"https:\/\/www.codeur.com\/blog\/?p=114245"},"modified":"2026-10-23T10:10:14","modified_gmt":"2026-10-23T08:10:14","slug":"faille-php2shell","status":"publish","type":"post","link":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/","title":{"rendered":"Faille PHP2Shell&nbsp;: si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd&#8217;hui"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Le 21 octobre 2026, l&#8217;\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour <strong>deux failles critiques<\/strong>, surnomm\u00e9es \u00ab <em>PHP2Shell<\/em> \u00bb. Une simple requ\u00eate suffit \u00e0 prendre le contr\u00f4le d&#8217;un site non mis \u00e0 jour, et des attaques sont d\u00e9j\u00e0 en cours. WordPress, PrestaShop, Drupal, Joomla&nbsp;: la grande majorit\u00e9 des sites web sont concern\u00e9s.<\/p>\n\n\n\n<div class=\"article-summary\">\n  <h3>En bref<\/h3>\n  <ul>\n    <li>Une faille critique dans PHP, surnomm\u00e9e PHP2Shell, permet de prendre le contr\u00f4le d&#8217;un site avec une simple requ\u00eate, sans mot de passe.<\/li>\n    <li>Des attaques sont d\u00e9j\u00e0 en cours, et les petits sites sont vis\u00e9s comme les autres.<\/li>\n    <li>Les risques sont le vol de donn\u00e9es, un site pirat\u00e9, un r\u00e9f\u00e9rencement ab\u00eem\u00e9 et un site indisponible.<\/li>\n    <li>La seule vraie parade est de passer \u00e0 PHP 8.5.12, 8.4.27, 8.3.36 ou 8.2.35. Les versions 8.1 et plus anciennes doivent migrer.<\/li>\n    <li>Pas s\u00fbr d&#8217;\u00eatre \u00e0 jour&nbsp;? <a href=\"https:\/\/www.codeur.com\/sysadmin\">Faites intervenir un professionnel<\/a> dans les heures qui viennent.<\/li>\n  <\/ul>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PHP2Shell, c&#8217;est quoi&nbsp;?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP est le langage qui fait tourner une grande partie des sites web. La faille <strong>PHP2Shell<\/strong> se trouve dans PHP lui-m\u00eame. Not\u00e9e 9,2 sur 10, elle <strong>permet \u00e0 un attaquant d&#8217;ex\u00e9cuter ses propres commandes sur votre serveur,<\/strong> sans identifiant ni mot de passe.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"999\" height=\"378\" src=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.png\" alt=\"annonce de la faille php\" class=\"wp-image-114262\" srcset=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.png 999w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-60x23.png 60w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-766x290.png 766w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-370x140.png 370w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-270x102.png 270w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-300x114.png 300w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-740x280.png 740w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-570x216.png 570w\" sizes=\"(max-width: 999px) 100vw, 999px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Votre CMS et vos extensions ne sont pas en cause, et les mettre \u00e0 jour ne suffit pas. <strong>Seule la mise \u00e0 jour de PHP corrige le probl\u00e8me.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Ce qu&#8217;une attaque peut co\u00fbter \u00e0 votre activit\u00e9<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Un attaquant qui prend la main sur votre serveur peut faire \u00e0 peu pr\u00e8s tout ce qu&#8217;il veut. Pour votre activit\u00e9, les cons\u00e9quences peuvent \u00eatre lourdes&nbsp;:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Vos fichiers clients, vos commandes et vos mots de passe peuvent \u00eatre vol\u00e9s, tout comme les cl\u00e9s d&#8217;acc\u00e8s \u00e0 vos outils de paiement, CRM ou emailing. Une fuite de donn\u00e9es personnelles doit \u00eatre <a href=\"https:\/\/cnil.fr\/fr\/notifier-une-violation-de-donnees-personnelles\" target=\"_blank\" rel=\"noreferrer noopener\">notifi\u00e9e \u00e0 la CNIL sous 72 heures<\/a>.<\/li>\n\n\n\n<li>Votre site peut \u00eatre pirat\u00e9 ou redirig\u00e9 vers des arnaques. Google risque alors de l&#8217;afficher comme \u00ab site dangereux \u00bb, et vos visiteurs ne reviendront pas.<\/li>\n\n\n\n<li>Des pages de spam inject\u00e9es en douce peuvent ab\u00eemer votre r\u00e9f\u00e9rencement pendant des mois avant que vous ne le remarquiez.<\/li>\n\n\n\n<li>Votre serveur peut servir \u00e0 envoyer du spam. Vos propres emails finissent alors en ind\u00e9sirables, et votre h\u00e9bergeur peut suspendre le site.<\/li>\n\n\n\n<li>Le site peut aussi \u00eatre bloqu\u00e9 ou ran\u00e7onn\u00e9. Chaque jour d&#8217;indisponibilit\u00e9 co\u00fbte des ventes ou des contacts, et la remise en \u00e9tat revient bien plus cher qu&#8217;une mise \u00e0 jour.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Pourquoi c&#8217;est urgent<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">La m\u00e9thode d&#8217;attaque circule publiquement depuis le 21 octobre. Une vid\u00e9o de d\u00e9monstration a \u00e9t\u00e9 diffus\u00e9e par erreur avant m\u00eame la sortie des correctifs, et <strong>Cloudflare a d\u00e9j\u00e0 observ\u00e9 des tentatives d&#8217;attaque<\/strong> contre les sites de ses clients.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La taille de votre site ne vous prot\u00e8ge pas. Les attaquants utilisent des robots qui testent automatiquement des milliers de sites \u00e0 la cha\u00eene. Tout site non mis \u00e0 jour finit par \u00eatre rep\u00e9r\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les sites les plus expos\u00e9s sont ceux qui ont \u00e9t\u00e9 livr\u00e9s puis <strong>laiss\u00e9s sans maintenance<\/strong>. C&#8217;est encore plus vrai s&#8217;ils tournent sous une ancienne version de PHP (8.1 ou avant)&nbsp;: pour celles-ci, il n&#8217;existe pas de mise \u00e0 jour officielle simple.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u00cates-vous concern\u00e9&nbsp;?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Voici trois questions \u00e0 vous poser&nbsp;:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>1. Quelle version de PHP fait tourner mon site&nbsp;? <\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Vous la trouverez dans l&#8217;espace client de votre h\u00e9bergeur. Sur WordPress, elle appara\u00eet aussi dans Outils > Sant\u00e9 du site.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>2. Qui g\u00e8re mon serveur&nbsp;? <\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Votre h\u00e9bergeur, un prestataire, ou personne&nbsp;?<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>3. Le correctif est-il appliqu\u00e9&nbsp;?<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les versions s\u00fbres sont <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noreferrer noopener\">PHP 8.5.12, 8.4.27, 8.3.36 et 8.2.35<\/a>, ou plus r\u00e9centes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Si vous ne savez pas r\u00e9pondre \u00e0 l&#8217;une de ces questions,<strong> consid\u00e9rez que votre site est expos\u00e9.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Que faire maintenant&nbsp;?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">La marche \u00e0 suivre d\u00e9pend de la fa\u00e7on dont votre site est h\u00e9berg\u00e9 et de sa version de PHP.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"620\" height=\"277\" src=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-demarche.png\" alt=\"marche \u00e0 suivre faille php\" class=\"wp-image-114283\" srcset=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-demarche.png 620w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-demarche-300x134.png 300w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-demarche-60x27.png 60w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-demarche-270x121.png 270w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-demarche-370x165.png 370w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-demarche-570x255.png 570w\" sizes=\"(max-width: 620px) 100vw, 620px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Si votre site est sur un <a href=\"https:\/\/www.codeur.com\/blog\/hebergement-mutualise\/\">h\u00e9bergement mutualis\u00e9<\/a> ou infog\u00e9r\u00e9, demandez par \u00e9crit \u00e0 votre h\u00e9bergeur s&#8217;il a appliqu\u00e9 le correctif, et quand.<\/li>\n\n\n\n<li>S&#8217;il tourne sur un serveur ou un VPS que personne ne maintient, faites mettre PHP \u00e0 jour imm\u00e9diatement par un d\u00e9veloppeur.<\/li>\n\n\n\n<li>S&#8217;il utilise PHP 8.1 ou une version plus ancienne, il faut le faire migrer vers une version maintenue. En attendant, un d\u00e9veloppeur peut poser une protection temporaire, mais ce n&#8217;est qu&#8217;un pansement. L&#8217;agence britannique de cybers\u00e9curit\u00e9 (<a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\" target=\"_blank\" rel=\"noreferrer noopener\">NCSC<\/a>) recommande m\u00eame de mettre ces sites hors ligne si ni la mise \u00e0 jour ni une protection temporaire ne sont possibles. En France, le <a href=\"https:\/\/cert.cyber.gouv.fr\/alerte\/CERTFR-2026-ALE-014\/\" target=\"_blank\" rel=\"noreferrer noopener\">CERT-FR<\/a>, rattach\u00e9 \u00e0 l&#8217;ANSSI, demande lui aussi d&#8217;isoler les syst\u00e8mes concern\u00e9s.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1000\" height=\"874\" src=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc.png\" alt=\"agence britannique de cybers\u00e9curit\u00e9\" class=\"wp-image-114288\" srcset=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc.png 1000w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc-300x262.png 300w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc-768x671.png 768w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc-60x52.png 60w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc-370x323.png 370w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc-270x236.png 270w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc-570x498.png 570w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php-ncsc-740x647.png 740w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Une fois la mise \u00e0 jour faite, changez les mots de passe et cl\u00e9s d&#8217;acc\u00e8s sensibles, puis faites v\u00e9rifier qu&#8217;aucun compte administrateur ou fichier suspect n&#8217;est apparu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Pas \u00e0 jour&nbsp;? Faites intervenir un d\u00e9veloppeur dans les heures qui viennent<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Vous n&#8217;\u00eates pas certain que votre site soit \u00e0 jour, ou personne n&#8217;en assure la maintenance&nbsp;? N&#8217;attendez pas&nbsp;! La mise \u00e0 jour prend g\u00e9n\u00e9ralement peu de temps \u00e0 un professionnel, alors qu&#8217;une attaque peut vous co\u00fbter des semaines.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Publiez d\u00e8s maintenant un projet \u00ab Mise \u00e0 jour PHP urgente \u00bb sur Codeur.com<\/strong> et recevez rapidement des devis de d\u00e9veloppeurs freelances.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button btn btn-primary\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.codeur.com\/sysadmin\">PUBLIER UN PROJET POUR S\u00c9CURISER MON SITE<\/a><\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Vous \u00eates d\u00e9veloppeur freelance&nbsp;?<\/em> C&#8217;est le bon moment pour v\u00e9rifier les sites de vos clients, et leur proposer un contrat de maintenance pour \u00e9viter la prochaine alerte.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Sources<\/em><\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/thephp.foundation\/blog\/2026\/10\/21\/todays-php-security-release-and-how-were-strengthening-php-security\/\" target=\"_blank\" rel=\"noreferrer noopener\"><em>PHP Foundation, Today&#8217;s PHP security release<\/em><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noreferrer noopener\"><em>php.net, annonce du 21 octobre 2026<\/em><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/cert.cyber.gouv.fr\/alerte\/CERTFR-2026-ALE-014\/\" target=\"_blank\" rel=\"noreferrer noopener\"><em>CERT-FR (ANSSI), alerte CERTFR-2026-ALE-014<\/em><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\" target=\"_blank\" rel=\"noreferrer noopener\"><em>NCSC, Critical security issue affecting PHP<\/em><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/cnil.fr\/fr\/notifier-une-violation-de-donnees-personnelles\" target=\"_blank\" rel=\"noreferrer noopener\"><em>CNIL, notifier une violation de donn\u00e9es personnelles<\/em><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.it-connect.fr\/php2shell-correctifs-urgence-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noreferrer noopener\"><em>IT-Connect, PHP2Shell&nbsp;: correctifs d&#8217;urgence<\/em><\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Le 21 octobre 2026, l&#8217;\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour deux failles critiques, surnomm\u00e9es \u00ab PHP2Shell \u00bb. Une simple requ\u00eate suffit \u00e0 prendre le contr\u00f4le d&#8217;un site non mis \u00e0 jour, et des attaques sont d\u00e9j\u00e0 en cours. WordPress, PrestaShop, Drupal, Joomla&nbsp;: la grande majorit\u00e9 des sites web sont concern\u00e9s. En bref [&hellip;]<\/p>\n","protected":false},"author":67,"featured_media":114247,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[140,16],"tags":[39],"class_list":["post-114245","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-php","category-securite","tag-conseils"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Faille PHP2Shell : si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd&#039;hui<\/title>\n<meta name=\"description\" content=\"Le 21 octobre 2026, l&#039;\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour deux failles critiques, surnomm\u00e9es \u00ab PHP2Shell \u00bb. Une simple requ\u00eate suffit \u00e0\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.codeur.com\/blog\/faille-php2shell\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Faille PHP2Shell : si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd&#039;hui\" \/>\n<meta property=\"og:description\" content=\"Le 21 octobre 2026, l&#039;\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour deux failles critiques, surnomm\u00e9es \u00ab PHP2Shell \u00bb. Une simple requ\u00eate suffit \u00e0\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.codeur.com\/blog\/faille-php2shell\/\" \/>\n<meta property=\"og:site_name\" content=\"Codeur.com\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/fr-fr.facebook.com\/codeurfreelance\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-22T13:12:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-23T08:10:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Aude Marty\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@martyaude\" \/>\n<meta name=\"twitter:site\" content=\"@codeur\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aude Marty\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/\"},\"author\":{\"name\":\"Aude Marty\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/person\\\/d6a8f77c2dd7441ef10ea2ef7abd0b57\"},\"headline\":\"Faille PHP2Shell&nbsp;: si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd&#8217;hui\",\"datePublished\":\"2026-10-22T13:12:40+00:00\",\"dateModified\":\"2026-10-23T08:10:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/\"},\"wordCount\":977,\"publisher\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/faille-php.jpg\",\"keywords\":[\"Conseils\"],\"articleSection\":[\"PHP\",\"S\u00e9curit\u00e9\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/\",\"name\":\"Faille PHP2Shell : si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd'hui\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/faille-php.jpg\",\"datePublished\":\"2026-10-22T13:12:40+00:00\",\"dateModified\":\"2026-10-23T08:10:14+00:00\",\"description\":\"Le 21 octobre 2026, l'\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour deux failles critiques, surnomm\u00e9es \u00ab PHP2Shell \u00bb. Une simple requ\u00eate suffit \u00e0\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/faille-php.jpg\",\"contentUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/faille-php.jpg\",\"width\":1200,\"height\":675,\"caption\":\"faille php\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-php2shell\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"D\u00e9veloppement\",\"item\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/developpement\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Langages\",\"item\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/developpement\\\/langages\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"PHP\",\"item\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/developpement\\\/langages\\\/php\\\/\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"Faille PHP2Shell&nbsp;: si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd&#8217;hui\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/\",\"name\":\"Codeur.com\",\"description\":\"codeur\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#organization\",\"name\":\"Codeur.com\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/logo-codeur-com.png\",\"contentUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/logo-codeur-com.png\",\"width\":2560,\"height\":465,\"caption\":\"Codeur.com\"},\"image\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/fr-fr.facebook.com\\\/codeurfreelance\\\/\",\"https:\\\/\\\/x.com\\\/codeur\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/codeur\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCgj9ySM9xy3gdL8qBafl9Uw\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/person\\\/d6a8f77c2dd7441ef10ea2ef7abd0b57\",\"name\":\"Aude Marty\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ae918d51b377a3b9585cfdc38b3d7078fa61c40e14449af59264a7b44e51f153?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ae918d51b377a3b9585cfdc38b3d7078fa61c40e14449af59264a7b44e51f153?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ae918d51b377a3b9585cfdc38b3d7078fa61c40e14449af59264a7b44e51f153?s=96&d=mm&r=g\",\"caption\":\"Aude Marty\"},\"description\":\"V\u00e9ritable touche-\u00e0-tout du web, Aude est toujours au courant des derni\u00e8res nouveaut\u00e9s et des nouveaux outils pour freelances.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/martyaude\\\/\",\"https:\\\/\\\/x.com\\\/martyaude\"],\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/author\\\/aude\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Faille PHP2Shell : si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd'hui","description":"Le 21 octobre 2026, l'\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour deux failles critiques, surnomm\u00e9es \u00ab PHP2Shell \u00bb. Une simple requ\u00eate suffit \u00e0","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/","og_locale":"fr_FR","og_type":"article","og_title":"Faille PHP2Shell : si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd'hui","og_description":"Le 21 octobre 2026, l'\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour deux failles critiques, surnomm\u00e9es \u00ab PHP2Shell \u00bb. Une simple requ\u00eate suffit \u00e0","og_url":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/","og_site_name":"Codeur.com","article_publisher":"https:\/\/fr-fr.facebook.com\/codeurfreelance\/","article_published_time":"2026-10-22T13:12:40+00:00","article_modified_time":"2026-10-23T08:10:14+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.jpg","type":"image\/jpeg"}],"author":"Aude Marty","twitter_card":"summary_large_image","twitter_creator":"@martyaude","twitter_site":"@codeur","twitter_misc":{"\u00c9crit par":"Aude Marty","Dur\u00e9e de lecture estim\u00e9e":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/#article","isPartOf":{"@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/"},"author":{"name":"Aude Marty","@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/person\/d6a8f77c2dd7441ef10ea2ef7abd0b57"},"headline":"Faille PHP2Shell&nbsp;: si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd&#8217;hui","datePublished":"2026-10-22T13:12:40+00:00","dateModified":"2026-10-23T08:10:14+00:00","mainEntityOfPage":{"@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/"},"wordCount":977,"publisher":{"@id":"https:\/\/www.codeur.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/#primaryimage"},"thumbnailUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.jpg","keywords":["Conseils"],"articleSection":["PHP","S\u00e9curit\u00e9"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/","url":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/","name":"Faille PHP2Shell : si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd'hui","isPartOf":{"@id":"https:\/\/www.codeur.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/#primaryimage"},"image":{"@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/#primaryimage"},"thumbnailUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.jpg","datePublished":"2026-10-22T13:12:40+00:00","dateModified":"2026-10-23T08:10:14+00:00","description":"Le 21 octobre 2026, l'\u00e9quipe PHP a publi\u00e9 en urgence des correctifs pour deux failles critiques, surnomm\u00e9es \u00ab PHP2Shell \u00bb. Une simple requ\u00eate suffit \u00e0","breadcrumb":{"@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.codeur.com\/blog\/faille-php2shell\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/#primaryimage","url":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.jpg","contentUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/10\/faille-php.jpg","width":1200,"height":675,"caption":"faille php"},{"@type":"BreadcrumbList","@id":"https:\/\/www.codeur.com\/blog\/faille-php2shell\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.codeur.com\/blog\/"},{"@type":"ListItem","position":2,"name":"D\u00e9veloppement","item":"https:\/\/www.codeur.com\/blog\/developpement\/"},{"@type":"ListItem","position":3,"name":"Langages","item":"https:\/\/www.codeur.com\/blog\/developpement\/langages\/"},{"@type":"ListItem","position":4,"name":"PHP","item":"https:\/\/www.codeur.com\/blog\/developpement\/langages\/php\/"},{"@type":"ListItem","position":5,"name":"Faille PHP2Shell&nbsp;: si votre site tourne sous PHP, mettez-le \u00e0 jour aujourd&#8217;hui"}]},{"@type":"WebSite","@id":"https:\/\/www.codeur.com\/blog\/#website","url":"https:\/\/www.codeur.com\/blog\/","name":"Codeur.com","description":"codeur","publisher":{"@id":"https:\/\/www.codeur.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.codeur.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/www.codeur.com\/blog\/#organization","name":"Codeur.com","url":"https:\/\/www.codeur.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2022\/04\/logo-codeur-com.png","contentUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2022\/04\/logo-codeur-com.png","width":2560,"height":465,"caption":"Codeur.com"},"image":{"@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/fr-fr.facebook.com\/codeurfreelance\/","https:\/\/x.com\/codeur","https:\/\/www.linkedin.com\/company\/codeur\/","https:\/\/www.youtube.com\/channel\/UCgj9ySM9xy3gdL8qBafl9Uw"]},{"@type":"Person","@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/person\/d6a8f77c2dd7441ef10ea2ef7abd0b57","name":"Aude Marty","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/ae918d51b377a3b9585cfdc38b3d7078fa61c40e14449af59264a7b44e51f153?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ae918d51b377a3b9585cfdc38b3d7078fa61c40e14449af59264a7b44e51f153?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ae918d51b377a3b9585cfdc38b3d7078fa61c40e14449af59264a7b44e51f153?s=96&d=mm&r=g","caption":"Aude Marty"},"description":"V\u00e9ritable touche-\u00e0-tout du web, Aude est toujours au courant des derni\u00e8res nouveaut\u00e9s et des nouveaux outils pour freelances.","sameAs":["https:\/\/www.linkedin.com\/in\/martyaude\/","https:\/\/x.com\/martyaude"],"url":"https:\/\/www.codeur.com\/blog\/author\/aude\/"}]}},"_links":{"self":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts\/114245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/users\/67"}],"replies":[{"embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/comments?post=114245"}],"version-history":[{"count":29,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts\/114245\/revisions"}],"predecessor-version":[{"id":114289,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts\/114245\/revisions\/114289"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/media\/114247"}],"wp:attachment":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/media?parent=114245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/categories?post=114245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/tags?post=114245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}