Prefecture sites and impots.gouv taken down for maintenance over a PHP flaw: what to do when your residence permit renewal is due
On 21 October the French state took some of its websites offline because of a critical PHP vulnerability. What still works, what doesn't, and why a residence permit renewal is best not left to the last day.
What happened
On 21 October, CERT-FR — the incident response team of ANSSI, France's national cybersecurity agency — issued alert CERTFR-2026-ALE-014 about two critical vulnerabilities in PHP, the programming language behind a large share of websites. The flaws, CVE-2026-109618 and CVE-2026-109619, allow an attacker to run arbitrary code on a server remotely. All 5.x to 8.1.x versions, which the developer no longer supports, are affected, as are the 8.2 to 8.5 branches before their patched releases. According to the alert, fixes were scheduled for 21 October at 16:00 Paris time, and the same-day update says they are out. CERT-FR's main advice is to isolate vulnerable systems and move to a supported version.
Franceinfo reports, citing the Interior Ministry, that in the afternoon the ministry put its affected websites into maintenance mode at ANSSI's request. Among the sites it lists as unreachable are the Paris police prefecture and several prefectures in Île-de-France, along with the Economy Ministry and Météo-France. The ministry gave no date for the sites to come back.
The shutdown is a precaution. The CERT-FR alert does not say the flaws are already being exploited.
What still works on impots.gouv
The impots.gouv home page shows a banner: the site is under maintenance, and documentation, news and form downloads are unavailable. The page also says the personal and professional accounts (espace particulier, espace professionnel) and online services remain available, including secure messaging, tax payments and managing prélèvement à la source. The eligibility simulator for the €100 "grands rouleurs" fuel aid for October to December 2026 is temporarily down.
What matters for foreign residents: the deadline, not the website
A day-long outage is a nuisance if your filing window is still open. It becomes a problem when a renewal is filed on the last day. Here is what the rules provide.
When to file. According to service-public (page on the multi-year carte de séjour pluriannuelle, checked 1 May 2026), a salarié or entrepreneur/profession libérale card is renewed at the prefecture or sub-prefecture within the 2 months before it expires; a carte étudiant is renewed on the ANEF website, no earlier than 4 months and no later than 2 months before expiry. For the carte de résident longue durée-UE (page checked 1 June 2026), the ANEF window is the same: between 4 and 2 months before expiry.
What a late filing costs. The page on the carte de résident longue durée-UE says that if you file late, a €180 droit de visa de régularisation is added to the cost of the card, unless there is force majeure or you hold a valid visa.
Why the deadline decides things. The attestation de prolongation de l'instruction is a temporary document proving that your stay is lawful while your file is being processed. According to service-public (checked 15 December 2023), it is issued if a complete file is submitted within the deadline set by the rules. It is valid for up to 3 months, and the prefecture renews it until a decision is made. It only allows you to work in certain cases — for example, when renewing a card that already gave the right to work.
Don't confuse it with the attestation de dépôt, the online filing receipt. That one is issued immediately, but it is not a residence document: it does not allow you to work and has no validity period.
What this means in practice
- File early in the window, not at the end: state websites do go down, as on 21 October, and a few weeks of margin removes the problem.
- Keep everything the service gives you: receipts, emails, your file number. If something fails because of an outage, take a screenshot showing the date and time.
- Check news about appointments at your prefecture on its own website once it is back, not on third-party "mirror" sites.
- Tax matters in your impots.gouv personal account can be handled now: it is working.
No further steps have been announced yet: the ministry has not given a date for full restoration.
This is general information based on official pages, not legal advice.
Fiscly is an educational tool to help you understand the French tax system. It is not a substitute for professional tax advice. Tax situations are individual — always verify with impots.gouv.fr or a qualified accountant (expert-comptable) for your specific case.