Critical PHP Vulnerability Prompts Tunisian Public Agencies to Suspend Online Services
A critical vulnerability in the PHP programming language has led several Tunisian public institutions to temporarily suspend their online services. Following the Tunisian Electricity and Gas Company (Steg), the Tunisian Agency for Technical Cooperation (Atct) announced on October 23 that it was taking its website offline as a preventive measure.
These decisions stem from two computer vulnerabilities that could allow an attacker to execute remote code on an exposed server. The National Cybersecurity Agency (ANCS) issued an alert on October 21, urging system administrators to apply the available patches. This situation raises questions about the security of digital platforms in Tunisia, as administrations and businesses increasingly rely on their online services.
The "PHP2Shell" Vulnerabilities
The two vulnerabilities, referenced as CVE-2026-109618 and CVE-2026-109619 and collectively known as "PHP2Shell," were reported in PHP, a language used to power a wide variety of websites and web applications.
- Severity: Rated 9.2 out of 10 according to the CVSS 4.0 assessment system.
- Risks: Vulnerable servers may be exposed to remote code execution, service disruption, or breaches of data confidentiality and integrity.
- Patches: On October 21, the PHP development team released fixed versions, including 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Official Response in Tunisia
The ANCS relayed the alert in its bulletin (tunCERT/Vuln.2026-657), published on October 21. The agency specified the affected versions and recommended updating to the patched releases.
It is important to note that this alert does not mean that all PHP-based sites have been compromised. However, it calls on affected organizations to verify their installations and secure any servers accessible from the Internet.
Institutional Actions
- Steg (Tunisian Electricity and Gas Company): Among the first Tunisian institutions to announce the interruption of its online services. In a statement, the public company indicated that its site would be temporarily disabled to prevent risks associated with the internationally reported vulnerability.
- ATCT (Tunisian Agency for Technical Cooperation): Took a similar measure the following day. In a statement published on its official Facebook page, the agency explained that the suspension aimed to protect its digital system and user data. It stated that it would inform the public once services were restored.
- OTC (Office of Topography and Cadastre): Also reported by the Tunisian press as having temporarily interrupted its services.
Clarification Regarding the Central Bank of Tunisia (BCT)
The case of the Central Bank of Tunisia (BCT), whose site was also reported as inaccessible, must be distinguished from the above announcements. At this stage, no official confirmation has been found to attribute this unavailability to the PHP2Shell vulnerability. A maintenance operation, a technical incident, or a security measure remain possibilities that need to be verified with the institution. The unavailability of a site, in itself, does not constitute proof of a hack.
International Context
These interruptions are part of a broader international context marked by the rapid reaction of several administrations and companies to the discovery of these vulnerabilities. European public services have also been temporarily taken offline to allow technical teams to secure their systems.
However, the release of a patch does not always eliminate all risks. IT managers must also verify that the update has been properly applied and search for any potential traces of suspicious activity that may have occurred prior to the publication of the alert.
