SPIP Vulnerability: Update to 4.4.14 Now

What happened

France's cybersecurity authority CERT-FR has issued an advisory warning of multiple vulnerabilities in SPIP, the open-source content management system. According to CERT-FR advisory CERTFR-2026-AVI-0564, published on 12 May 2026, the vulnerabilities affect all SPIP versions prior to 4.4.14.

The core risk is serious: the vulnerabilities allow an attacker to perform remote arbitrary code execution. In plain terms, this means someone outside your organisation could potentially run malicious code on your server without needing physical access to it.

Who is affected

If your website runs on SPIP and you have not yet updated to version 4.4.14, your site may be at risk. CERT-FR advises users to apply the vendor's security bulletin to obtain the necessary patches. The fixed version is SPIP 4.4.14.

What you should do

According to CERT-FR, the recommended action is straightforward: update SPIP to version 4.4.14. To do this:

1. Check your SPIP version. Log in to your SPIP admin panel and look for the version number, usually displayed in the dashboard or settings area.
2. Apply the update. Follow the instructions in the SPIP security bulletin to install the patched version.
3. If you use a web developer or agency, contact them today and ask them to confirm your SPIP installation is running version 4.4.14 or later.

If you are unsure whether your website uses SPIP, your web developer or hosting provider can check this for you.

Keeping your site secure

Vulnerabilities like this are a reminder that keeping your website software up to date is one of the most important things you can do for your business. Outdated software is one of the most common entry points for attackers. Our security checklist for small businesses walks you through the basics, and our guide on vulnerable plugins and software explains what to look out for more broadly.

What does this mean for your website?

If your website runs on SPIP, this advisory applies to you directly and updating to version 4.4.14 should be your priority this week. Under UK GDPR and the Data Protection Act 2018, you have a responsibility to keep personal data secure, and running software with known vulnerabilities could put you in breach of that obligation. Taking action now is both a practical and a legal safeguard for your business.