# Critical PHP Vulnerability: PM Urges Patch

> Japanese PM urges PHP patch amid critical security flaws.
- Title: Critical PHP Vulnerability: PM Urges Patch · BigGo Finance
- Summary: Japanese PM urges PHP patch amid critical security flaws. Japanese Prime Minister Sanae Takaichi called for urgent PHP patch application after two critical…
- Keywords: php, sanae takaichi, critical vulnerability, php 8.5.12, php 8.4.27, php 8.3.36, php 8.2.35, remote code execution, php patch, site shutdown, finance, markets
- Source: BigGo Finance — https://finance.biggo.com/news/ecd6fc47-2403-4e2c-90d1-bc2b32b48fad
- Author: BigGo Finance
- Published: 2026-10-21T14:25:09+00:00
- Read time: 1 min
- Topics: php, sanae takaichi, critical vulnerability, php 8.5.12, php 8.4.27, php 8.3.36, php 8.2.35, remote code execution, php patch, site shutdown, finance, markets
## Critical PHP Vulnerability
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) rated 9.2 under CVSS v4.0 could allow remote code execution without authentication.

> This is an urgent request for everyone to respond to tonight
## PM Takaichi's Urgent Call
Japanese Prime Minister Sanae Takaichi urged prompt patch application and temporarily suspending sites when patching is difficult.

> please make preparations so that it can be applied as swiftly as possible
## Patch Release Timeline
PHP patch released ahead of schedule at 10:40 p.m. Japan time on Oct. 21 (9:40 a.m. EDT on Oct. 21).
## Affected PHP Versions
Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with end-of-support versions PHP 8.1 and earlier outside update scope.
## Government Response
Japan's National Cybersecurity Office and Information-technology Promotion Agency issued advisories urging swift action.
## Immediate Impact
CoDMON, Shadowverse: Worlds Beyond, BASE, and Sakura Internet services entered emergency maintenance or announced plans to do so.
## Attack Potential
Exploiting the vulnerability could lead to website takeover, data theft, encryption, or ransomware attacks.

> Information leaks are a given, but there is also a high possibility that data will be encrypted and a ransom demanded, as in ransomware attacks
## Interim Measures
PHP lists interim measures like session.upload_progress.enabled=0 and memory_limit=-1 for temporary risk reduction.
## Next Steps
System administrators must decide whether to apply the patch or take alternative measures until patching is complete.
## Key takeaway

Japanese Prime Minister Sanae Takaichi called for urgent PHP patch application after two critical vulnerabilities were found, with site shutdown as a temporary measure.