TOKYO: Japanese Prime Minister Sanae Takaichi on Wednesday urged organisations to check if their public websites were using PHP, a programming language that runs websites, as their developers released emergency security updates to fix critical cybersecurity flaws.
The warning comes amid major websites worldwide, including in the US and Europe, going offline as operators race to protect systems from hackers.
In a post on X, PM Takaichi wrote,”We have an urgent request for everyone to take action tonight. Regarding PHP, which is used on many websites, the PHP security team has issued a warning about two critical vulnerabilities. Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released at 11 PM on October 21 (Japan time) as soon as possible.”
She said if there is an issue with fixing the patch promptly, then temporary suspension of websites can be considered.
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X— 高市早苗 (@takaichi_sanae) October 21, 2026
“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk. Related information is also being posted on the X account of the National Center of Incident Readiness and Strategy for Cybersecurity, so please refer to that as well. National Center of Incident Readiness and Strategy for Cybersecurity (Notice and Alert Information),” Japan PM added.
Similar warnings were issued in the US, with the NSA and FBI issuing advisories. The FBI’s cyber division wrote on X, “Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.”
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
— FBI Cyber Division (@FBICyberDiv) October 21, 2026
If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated, Bureau added. The FBI urged organisations to report any signs of compromise.
“Isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or http://ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims,” it said.
US National Security Agency, a cybersecurity arm, also stated that organizations must take the system offline if immediate update is not feasible.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance,” it said.
The developers have identified the vulnerabilities — CVE-2026-109618 and CVE-2026-109619. The vulnerabilities stem from memory management issues and stale internal state that may persist across requests, potentially enabling attackers to execute malicious code on vulnerable servers. (ANI)
