From BigGo Finance · BigGo Finance · · 1m 20s
Critical PHP Vulnerability: PM Urges Patch
Japanese PM urges PHP patch amid critical security flaws.
In brief
Japanese PM urges PHP patch amid critical security flaws. Japanese Prime Minister Sanae Takaichi called for urgent PHP patch application after two critical vulnerabilities were found, with site shutdown as a temporary measure. Originally reported by BigGo Finance.
Critical PHP Vulnerability
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) rated 9.2 under CVSS v4.0 could allow remote code execution without authentication.
“This is an urgent request for everyone to respond to tonight”
PM Takaichi's Urgent Call
Japanese Prime Minister Sanae Takaichi urged prompt patch application and temporarily suspending sites when patching is difficult.
“please make preparations so that it can be applied as swiftly as possible”
Patch Release Timeline
PHP patch released ahead of schedule at 10:40 p.m. Japan time on Oct. 21 (9:40 a.m. EDT on Oct. 21).
Affected PHP Versions
Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with end-of-support versions PHP 8.1 and earlier outside update scope.
Government Response
Japan's National Cybersecurity Office and Information-technology Promotion Agency issued advisories urging swift action.
Immediate Impact
CoDMON, Shadowverse: Worlds Beyond, BASE, and Sakura Internet services entered emergency maintenance or announced plans to do so.
Attack Potential
Exploiting the vulnerability could lead to website takeover, data theft, encryption, or ransomware attacks.
“Information leaks are a given, but there is also a high possibility that data will be encrypted and a ransom demanded, as in ransomware attacks”
Interim Measures
PHP lists interim measures like session.upload_progress.enabled=0 and memory_limit=-1 for temporary risk reduction.
Next Steps
System administrators must decide whether to apply the patch or take alternative measures until patching is complete.
The takeaway
Japanese Prime Minister Sanae Takaichi called for urgent PHP patch application after two critical vulnerabilities were found, with site shutdown as a temporary measure.
