Temporarily suspended as a precaution following a global security flaw affecting the PHP language, ALPI's services are now accessible again. These interruptions were a precautionary measure: no cyberattack was detected on ALPI's systems.
On October 20th, the PHP project announced two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). PHP is a programming language used by a vast majority of websites and web applications worldwide. These flaws could allow an attacker to execute remote code on an unpatched server. The European institutions' cyber incident response center (CERT-EU) recommended immediate patching of affected systems or, failing that, isolating them from the internet. Official patches were released on October 21st.
This vulnerability does not specifically concern ALPI; it affects a component used by many publishers and hosts, both in France and abroad. While awaiting patches, access to several applications was suspended to protect the data of our members. These interruptions do not mean a cyberattack was detected. We chose to follow CERT-EU's recommendations to eliminate any risk, in the interest of all Landes communities.
Our technical teams and publishers deployed the patches as soon as they were available and conducted the necessary security checks before each service restoration. With the exception of FOAD, all ALPI services are now accessible again.
We invite you to relay this information to your IT Directors, CISOs, and the agents within your structure. If you encounter difficulties, you can open a ticket on Sidoni or contact our teams.
