NIS2 is a European directive, to be written into the law of each EU country, that greatly expands the number of organizations subject to cybersecurity obligations. Transposing NIS2 in France is the job of the “NIS2 law”: the projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité (bill on the resilience of critical infrastructure and the strengthening of cybersecurity), whose examination in the Assemblée nationale (National Assembly), scheduled for early October 2026, has been postponed with no new date.

Even if the law does not cover it, an SME that works for an organization in scope will see that organization’s requirements arrive through the contract: it is better to prepare for them.

Where NIS2 in France stands on October 21, 2026

EU countries had to transpose the directive by October 17, 2024 at the latest. In France, the bill, tabled in the French Senate on October 15, 2024 under the accelerated procedure, was adopted there at first reading on March 12, 2025; the National Assembly’s special committee adopted its version of the text on September 10, 2025. The bill transposes three directives: NIS2, the directive on the resilience of critical entities and the directive linked to the DORA regulation for the financial sector.

Scheduled for debate in plenary session on October 7 and 9, 2026, the text was removed from the agenda on October 6; the meetings that set this agenda did not put it back on October 13 and 20. No new date has been set so far (see the National Assembly’s legislative file, in French).

On July 8, 2026, the European Commission decided to refer France, Spain, Ireland and the Netherlands to the Court of Justice of the European Union over this delay. It is asking the Court for a lump sum and daily penalty payments (penalties for each day of delay) until the directive is fully transposed.

Once the law is enacted, the implementing decrees and orders will follow. According to ANSSI, the French national cybersecurity agency, in its FAQ on the progress of the transposition (in French), NIS2 will enter into force in France when all these texts are published, without every requirement applying from that date: the compliance deadlines have not yet been set.

NIS2: who is directly affected

According to ANSSI, several thousand organizations will be affected, mostly medium-sized and large companies, local authorities and public administrations. Their 18 sectors fall into two groups:

• “sectors of high criticality”, including energy, transport, health, drinking water, digital infrastructure, banking and providers that manage other companies’ IT (managed IT services);
• the other “critical sectors”, including manufacturing, the food industry, waste management, chemicals, postal services and digital providers.

A company in a sector of high criticality is in principle an “essential entity” if it employs at least 250 people, or if its annual turnover exceeds €50 million and its balance sheet €43 million. Other companies in the sectors concerned are “important entities” if they employ at least 50 people, or if their annual turnover and balance sheet exceed €10 million. Micro and small enterprises are in principle not subject to the law, except in specific cases (certain domain name operators, for example).

To check your situation, ANSSI offers an online test on MonEspaceNIS2 (in French), where organizations can also pre-register.

What companies in scope will have to do

ANSSI sums up the framework in three obligations: register with ANSSI, the competent national authority; put in place risk management measures to meet the security objectives set by the French text; report significant incidents and critical security vulnerabilities to ANSSI.

These measures are described in ANSSI’s Référentiel Cyber France (ReCyF, the French cybersecurity framework), whose version 2.5 of March 17, 2026 is still a working version that may change with the parliamentary debates. It sets 20 security objectives: the first fifteen for important and essential entities, the last five for essential entities only. According to ANSSI, these objectives will become mandatory by decree once the law is enacted; the “acceptable means of compliance” proposed to achieve them will in principle remain optional, except in specific cases. Certain digital players fall under a specific European regulation.

Finally, the directive requires management to approve these measures, oversee their implementation and be liable in the event of non-compliance. According to ANSSI, penalties could reach €10 million or 2% of worldwide annual turnover for an essential entity, and €7 million or 1.4% for an important entity.

Suppliers and service providers: affected without being targeted

The directive also requires organizations to ensure “supply chain security”, including in their relationships with direct suppliers and service providers. The ReCyF turns this into an objective, “Maîtrise de l’écosystème” (control of the ecosystem), whose proposed means provide in particular that the company in scope:

• keeps an up-to-date list of its IT service providers and suppliers, with a contact for each;
• makes sure that each service complies with its own obligations, particularly in risk management and incident reporting, and obtains contractual guarantees: a security assurance plan (the provider’s written security commitments), a remote maintenance charter (rules for remote interventions) or monitoring indicators, for example;
• regularly checks this compliance, possibly through audits.

The business software vendor, managed IT services provider or hosting provider of a company in scope should therefore expect security questionnaires, contract clauses and audit requests. These requirements will come from the contract, not from the law, but could carry weight when contracts come up for renewal.

What your SME can prepare now

A few basic workstreams, inspired by the ReCyF, cover most of a client’s questions:

• a list of your systems, administrator accounts and access to your clients’ systems;
• multi-factor authentication (a code or a key in addition to the password) for remote access and for accounts with extended rights;
• regular security updates, following CERT-FR alerts (the French government’s alert center), and software still supported by its vendor;
• protected backups and restores that are actually tested;
• an incident procedure, with a person responsible for notifying your clients without delay;
• a file ready to send: measures in place, the list of your subcontractors, commitments you can keep. It is better to commit to what you know you can deliver than to sign a security annex you cannot apply.

A concrete example

Take, as an illustration, a 20-person SME with turnover below €10 million that develops and hosts the scheduling application of a group of private clinics with 400 employees. The SME is in principle not subject to the law. Its client, in the health sector (high criticality) and with more than 250 people, would in principle be an essential entity. Before renewing the contract, the client sends a questionnaire on these same topics, including update timeframes, and asks the SME to accept an audit.

If the SME has inventoried its access, enabled multi-factor authentication on the hosting administration, tested a full restore and written a short security assurance plan, it answers point by point, with evidence. The questionnaire becomes a sales argument rather than a risk of losing the contract.

Frequently asked questions

Is the NIS2 law already in force in France?

No. As of October 21, 2026, the National Assembly has not debated in plenary session the bill adopted by the Senate. The two chambers will then need to vote the text in identical terms, if necessary after a commission mixte paritaire (a joint committee where deputies and senators meet to reach an agreement), followed by enactment and the decrees.

My company has fewer than 50 employees: is it affected?

With fewer than 50 people and turnover or a balance sheet not exceeding €10 million, it is in principle not directly subject to the law, except in specific cases. If you work for an essential or important entity, its requirements will reach you through the contract.

Should I register on MonEspaceNIS2 now?

Pre-registration is open to organizations that know they are in scope, but the obligation will only apply once the law is in force. A subcontracting SME that is not subject to the law does not need to register: that step falls to its client, if the client is in scope.

411bit supports small businesses, SMEs and mid-sized companies in preparing for NIS2: cybersecurity audit, choice of priority measures, help answering your clients’ questionnaires and then, if you wish, monitoring and ongoing maintenance and support (supervision and upkeep of your systems), with a fixed-price quote per deliverable. Contact us to discuss it: every request receives a reply within 24 business hours. See also: securing your IT without holding back growth.

The “PHP vulnerability” patched on October 21, 2026 covers two critical flaws, nicknamed “PHP2Shell” by security researchers. They can allow an attacker, without any username or password, to run their own commands on your website’s server, with the website’s permissions. According to PHP, any installation that runs a website or web application is affected.

Is your website or application built on WordPress, PrestaShop or another tool written in PHP? It remains exposed until PHP has been updated on the server, even if it is well designed.

What you need to know about this PHP vulnerability

Announced by PHP the day before for 4 p.m. (Paris time), the patches were released on October 21. According to PHP’s security advisory, in some configurations a single anonymous request was enough to demonstrate an attack, before the website itself even came into play. According to several security firms, details were circulating online before the patches came out.

CERT-FR, the alert service of ANSSI (the French national cybersecurity agency), has published an alert (in French). It considers all PHP versions from 5 to 8.1 affected, as well as versions 8.2 to 8.5 released before the patches. Since October 21, security firms have been reporting attack attempts, with findings that still differ on their scale. According to PHP, no workaround is complete: only the update protects you.

Why updating WordPress is not enough

The flaws are in PHP itself, the engine that runs your website, not in WordPress, PrestaShop or development tools. Updating plugins or your theme therefore fixes nothing: PHP must be replaced on the server, then restarted. Be wary of plugins presented as “PHP2Shell fixes”: since they run on PHP, they cannot repair it.

For one of the flaws, PHP’s advisory also reports a leak of information from the server’s memory. According to researchers, an attacker can retrieve passwords, data that keeps a user logged in, or access keys from it. A website with no visible damage may therefore have leaked sensitive information.

Who needs to act depends on your hosting:

• shared hosting (a shared server) or managed platform: your host, not you;
• dedicated or virtual server: you or your managed IT services provider;
• application running in “containers” (Docker, for example): whoever maintains it, by rebuilding it with a patched PHP.

Check whether your website is protected

Find the PHP version your website uses:

• WordPress: Tools, then Site Health, Info tab, Server section;
• PrestaShop: Advanced Parameters, then Information;
• Laravel, Symfony or custom-built: ask your developer for the version used by the web server, which is sometimes different from the command-line version.

Version 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer version in the same series, means the patch is active. An older version is not necessarily vulnerable: PHP states that Linux distribution vendors and extended support providers received the patches in advance. And they can include a patch without changing the version number displayed.

If in doubt, ask your host for written confirmation: patches for both flaws applied, PHP restarted afterwards (otherwise the old version keeps running), and the date of the work.

If your website still runs on PHP 8.1 or 7.x

PHP 8.1 and earlier versions no longer receive official updates. PHP has nonetheless published minimal patches for 7.4, 8.0 and 8.1, for those who build PHP themselves from the source code. Three actions are needed:

• look for a patched version from your Linux distribution vendor or an extended support company, or have the patch published by PHP applied;
• apply, starting today, the two temporary measures cited by CERT-FR: disable file upload progress tracking, and filter these uploads with a web application firewall (a filter placed in front of the website);
• plan the move to a maintained version without delay.

These measures reduce the risk without eliminating it: CERT-FR has not validated them, and the first covers only one of the two flaws. This filtering also blocks legitimate file uploads and may disrupt some forms, so test it. For unsupported versions, CERT-FR recommends isolating the affected systems, then migrating. Aim for PHP 8.3 at a minimum, ideally 8.4 or 8.5: according to PHP’s official schedule, 8.2 will no longer receive security patches after December 31, 2026. Moving from PHP 7 to PHP 8 often requires adapting the code, which should be validated on a test copy.

How to tell whether your website has been hacked

Patching PHP does not tell you what may have happened before. Have your host or provider check, at a minimum:

• PHP files recently added or modified on the website: an attacker may have hidden a backdoor in them;
• new administrator accounts, on the website as well as on the server;
• unknown scheduled tasks and programs launched by PHP;
• in the logs, unusual file uploads followed by memory errors or repeated server errors, and unexplained PHP restarts.

None of these signs is proof on its own, and their absence guarantees nothing. If in doubt, change the credentials stored on the server: database, connections to other software, payment, email sending. Keep the logs before any cleanup, for analysis and a possible complaint. If personal data may have been accessed, the GDPR requires you to notify the CNIL (French data protection authority) no later than 72 hours after becoming aware of it, if the breach poses a risk to individuals.

What to send your host or provider

• CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 (CVSS 4.0); alert CERTFR-2026-ALE-014;
• patched versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35, then restart of the PHP processes;
• highest risk with Apache and mod_php; attack also validated on PHP-FPM for one of the flaws;
• 8.1 and earlier: workarounds not qualified by CERT-FR, session.upload_progress.enabled set to Off (php.ini or PHP-FPM pool) then restart, and blocking at the WAF, or failing that monitoring, of multipart requests.

A concrete example

Take, as an illustration, a 20-person SME: a WordPress showcase website with a shared hosting provider, and a Laravel client portal on a dedicated server running PHP 8.1. The showcase website shows 8.3.36 in Site Health: the patch is active. The client portal is trickier, since there is no official patched version of 8.1. The same day, the provider disables upload progress tracking, filters file uploads where they are not needed and looks for a patched version from the Linux vendor. It then checks the logs and files and has the access keys renewed. The move to PHP 8.4, with the Laravel update it requires, is prepared on a test copy.

Frequently asked questions

My website is on shared hosting: what should I do?

You cannot update PHP yourself. You can, however, check the version displayed, ask your host for written confirmation and move off an old version (7.4 or 8.1) if your plan allows it.

Is a firewall enough to protect my website?

No. A web application firewall can block known attacks and buy time, but it only filters the traffic that passes through it and does not fix PHP.

Should I take my website offline in the meantime?

If the update is delayed and the website handles payments or sensitive data, cutting off access is reasonable, in the spirit of the isolation recommended by CERT-FR. The “maintenance mode” of WordPress or of an online store does not protect you: the attack happens before the website comes into play. The shutdown must therefore be done on the server or by the host.

On October 21, as soon as the patches were published, 411bit updated PHP on the servers of the clients for whom it provides managed IT services. To help you take stock, 411bit can check the PHP version of your websites and applications, apply the update or help you deal with your host, move an application still on PHP 8.1 or 7.x to a maintained version, and look for possible signs of a hack, with a response within 24 business hours: describe your situation to us. If your application was developed by another provider, the takeover of an industrial B2B platform illustrates the approach: a security audit first, then taking over the platform.

Cybersecurity for small business is often seen as a drag on day-to-day work: imposed passwords, blocked access, slower projects. That is a false dilemma. Done well, security protects your company without getting in your teams’ way, and it stays invisible day to day.

Most business owners put off the security question for fear of slowing their teams down. It is a false dilemma: well-designed security is invisible day to day and only shows on the day it saves you.

The real risks for an SME

• Ransomware that encrypts files and halts production
• A fake supplier email that diverts a bank transfer
• A former employee whose access was never revoked
• A backup that was never tested and turns out to be unusable on the day you need it

“We’re too small for anyone to bother with us”

It is the sentence we hear most often, and it is the most mistaken. The attacks that hit SMEs are almost never targeted. They are automated campaigns that sweep through thousands of addresses and stop at the ones that do not hold up. Your size does not protect you: it just makes you an easier target than a large group with a dedicated team.

A concrete example

Take a 30-person industrial SME. One Friday afternoon, an employee opens an attachment that looks like a supplier invoice. On Monday morning, the production files are encrypted.
The damage tally:

• Four days of operations at a standstill, or about €40,000 in revenue delayed or lost.
• A backup that existed but had never been tested: three weeks of data that could not be recovered.
• Customers informed late, and two orders canceled.

The measures that would have prevented all of this cost a few hundred euros a month: network segmentation, a backup tested every month, and twenty minutes of awareness training per employee. That is the whole security equation for an SME.

Cybersecurity for small business in six concrete measures

1. Segment the network: one compromised computer must not give access to everything
2. Secure remote access with encrypted connections
3. Check your backups: an untested backup does not exist
4. Disable unused accounts: departed employees, interns, contractors
5. Train your teams: most incidents start with an email
6. Monitor: detect an anomaly within hours rather than weeks

We knew we had security gaps, without knowing which ones. The audit laid everything out, with a clear, costed action plan. Not a single incident since.

Where to start

With an assessment. In a few weeks, a security audit answers three questions: where your real risks are, which ones to address first, and what each measure costs. You come away with a ranked list of projects, not an 80-page report that nobody will read.

Frequently asked questions

Isn’t antivirus software enough?

No. Antivirus software stops some known threats, but it does nothing against a fake supplier email, a forgotten access or a faulty backup. Most incidents in SMEs go around the antivirus, not through it.

How much does a security audit cost?

For an SME, expect a few days of work, depending on the number of devices. That is nothing compared with the cost of a production shutdown, and above all it keeps you from investing at random in tools you do not need.

Will my teams be held back?

If security gets in the way, it is poorly designed. Encrypted remote access, properly configured two-factor authentication or automatic backups change nothing in users’ daily work. What really stops teams in their tracks is ransomware.

What should you do if you are already under attack?

Disconnect the affected machines from the network without turning them off, do not pay, and call in someone competent right away. How fast you react makes all the difference between a few hours of interruption and several weeks.
411bit carries out security audits with a report a business owner can read and a prioritized, costed action plan. Request your audit.
Further reading: the recommendations of ANSSI (French national cybersecurity agency, in French) and our article on ERP migration without interruption.