Two serious vulnerabilities in PHP, used by 70% of websites worldwide, were disclosed, and a patch was released on the 21st Japan time. Domestic companies and government-related services were forced into emergency maintenance, in an unusual situation that prompted Prime Minister Takaichi (高市) to issue a warning.
PHP's security team urgently released multiple versions of PHP on the 21st after announcing a special release to fix two vulnerabilities rated critical.
The versions released were 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and action is being taken urgently.
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. The former could allow internal data to be read when memory is insufficient, while the latter is a "Use-After-Free" issue that could allow information in freed memory to be reused. If the conditions are met, either could lead to remote code execution.
The impact extends to major systems running on PHP, including WordPress and Nextcloud, while the conditions required for an attack to succeed vary depending on the server configuration. Execution environments such as Apache's mod_php, PHP-FPM, php-cgi and LiteSpeed need to be inspected.
In Japan, さくらインターネット, pixiv and ニコニコ, among others, entered emergency maintenance, and corporate websites and online services were repeatedly taken offline or placed under maintenance. Prime Minister Takaichi (高市) also called for action on X, as the government and other parties concerned heightened their vigilance.