Home / Technology / PHP Flaws Spark Global Security Alert
PHP Flaws Spark Global Security Alert
22 Oct
Summary
- Critical vulnerabilities in PHP language pose remote code execution risks.
- Japan suspended government and other websites as a precaution.
- Australia also advised organizations and individuals to monitor PHP applications.
Two critical vulnerabilities in the PHP programming language have been identified, prompting urgent security advisories from developers. These flaws, detailed as CVE-2026-109618 and CVE-2026-109619, stem from memory-handling errors and outdated internal states, potentially allowing attackers to execute malicious code remotely without authentication.
In response, Japan has temporarily suspended various websites, including its Health, Labor and Welfare Ministry's information disclosure system, as well as online store service BASE and Tokyo University of Foreign Studies' web servers. Sakura Internet Inc. also suspended some service functions. Japan's National Cybersecurity Office has urged all users to install the released security patches.
Australia's Signals Directorate has echoed these concerns, advising both organizations and individuals to closely monitor their PHP applications and be ready to apply necessary updates. The extensive use of PHP across the internet means that unpatched systems present a substantial risk and opportunity for malicious actors.
