A report by the Financial Times found 2 serious vulnerabilities in PHP that could allow arbitrary code to be executed remotely without authentication. Preventive shutdowns have spread among Japanese companies, accelerating moves to address the issue.
According to a report by the Financial Times, PHP contains 2 extremely serious vulnerabilities that could allow attackers to execute arbitrary code remotely without authentication. The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, creating a situation in which websites operated by companies and organisations using PHP could become targets of attack. In response, several companies have indicated that they are taking steps to strengthen their security measures.
Alibaba Cloud and Tencent Cloud, two major Chinese cloud service providers, issued emergency notices urging customers to promptly update to patched versions. Emergency measures to prevent exploitation of the vulnerabilities are being called for worldwide. The FT article has brought the situation broad attention, and Japanese companies have also been alerted.
ANA temporarily suspended services on its official website and app, reportedly affecting the electronic boarding-pass function in Apple Wallet as well. The scope of the impact could expand to include government agencies and infrastructure, and companies' response policies are drawing attention.
The article reports on companies' responses to the PHP vulnerabilities and developments in their ongoing measures, while readers are also focusing on information such as patch deployment status and whether any attacks have occurred in further updates.