October 2026

October 21, 2026

  1. New Mexico judge orders Meta to pay $25 billion for deceiving the public about Facebook privacy
  2. Critical PHP flaws prompt government agencies and banks to take websites and services offline

October 19, 2026

  1. Kenyan cult leader Paul Mackenzie and 28 others convicted of murdering 191 people, nearly all of them children
  2. Car strikes Australian independent MP Helen Haines outside her office, leaving her in critical condition

October 18, 2026

  1. Ukrainian drone attack on St. Petersburg sets oil terminal ablaze and hits VK data center
  2. Macron says 'we all feel anger and shame' after protests across France turn into riots
X

Critical PHP flaws prompt government agencies and banks to take websites and services offline

October 21, 2026 at 05:51 PM

Two critical flaws that let attackers run code on servers remotely without authenticating have been found in PHP, a programming language widely used to build websites, and its developers released fixed versions on Oct. 21, late at night Japan time [1][2]. Both flaws are rated 9.2 out of 10 for severity [3], and as cybersecurity authorities in the U.K. and the European Union urge organizations that cannot act right away to cut their systems off from the internet, banks, brokerages and railway companies in Japan have been taking websites and services offline one after another [3][4][5].

PHP runs on the server side, where it builds web pages, and WordPress, Drupal and MediaWiki, the software behind Wikipedia, are all written in it [4][6]. According to figures from a European research organization, 69.3 percent of websites whose server-side language is known use PHP [7][8], and Wiz, the security company that found the flaws, says they affect 70 percent of the internet [6].

One of the fixed flaws lets out-of-memory handling cut in while request data is still only partly set up, so that the cleanup that follows treats the broken data as valid, and the other leaves internal state behind after the memory backing it has been freed, so that the next request handled by the same worker can pick up that stale state [1]. The developers say every PHP installation that serves web requests is at risk, and that with Apache's mod_php they demonstrated an exploit in which an unauthenticated request triggers the attack before any application code runs [1]. The advisory posted on GitHub says full remote code execution was confirmed over HTTP against mod_php running with PHP's default input and memory limits [9].

The announcements for all four fixed versions, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, carry the same sentence [10].

There are no complete mitigations, updating is the only safe choice.

PHP (PHP 8.5.12 Released!)

PHP 8.1 and older, which no longer receive updates from the project, are not covered by the releases, but given the severity, the PHP security team also provided minimal source code backports for versions 7.4, 8.0 and 8.1 [1]. The team listed configuration changes for those who cannot update immediately, while stressing that they only narrow specific attack paths and do not make an installation safe [1].

The flaws were found by researchers at Wiz and at the security firm Calif, and Wiz said it discovered the first one with the help of artificial intelligence on Aug. 19 and reported its findings to the PHP security team on Aug. 24 [6]. The problems stem from design decisions, some of them more than a decade old, and Wiz said that showing they could actually be exploited required a chain of steps "at the edge of what human researchers could practically achieve," a barrier that frontier AI models greatly lowered [6]. According to the BBC, Calif took part, along with the PHP Foundation, in an OpenAI program called Patch the Planet and used the company's AI tools to hunt for flaws [11]. The findings were meant to be disclosed later this month together with a complete fix, but details leaked on social media on Oct. 20, forcing a rushed announcement [11].

The response spread from country to country over the course of Oct. 21, with Finland temporarily shutting down the government's public web services and the Netherlands' cybersecurity agency taking its own website offline [11]. The U.S. National Security Agency advised on X that organizations unable to apply the fix should take their systems offline, and parts of Wikipedia became unreachable after the Wikimedia Foundation took down a number of systems as a precaution [11]. The U.K.'s National Cyber Security Centre, warning that all versions may be affected, asked organizations to identify every system running PHP and included this among its recommended steps [4].

If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.

NCSC (Critical security issue affecting PHP)

The European Union's Computer Emergency Response Team, CERT-EU, said technical details were being discussed publicly after the fixes came out and that initial proofs of concept had begun to circulate, which "raises the likelihood that attackers are already exploiting the vulnerabilities" [3]. The chief technology officer of Cloudflare, which provides infrastructure for much of the internet, also said the company was seeing early attacks and was updating its defenses as new attack methods turned up [11][12].

In Japan, the government-affiliated Innovation Platform Agency (IPA) issued an alert on Oct. 21 asking organizations to get ready before the fixes came out, noting that some websites were still running old PHP versions that are no longer supported and that attackers could move to exploit the flaws within a very short time [13]. The National Cybersecurity Office also urged prompt action, including applying patches, and Prime Minister Sanae Takaichi posted on X that when a quick response is difficult, temporarily taking a site down is one effective way to lower the risk [7][8].

The Japanese Bankers Association said no impact on settlements between banks had been confirmed, but Shizuoka Bank suspended its internet banking, and The 77 Bank also halted some services as a precaution [5]. Mizuho Bank carried out temporary maintenance, Daiwa Securities suspended services on its website, including account opening, and Mitsubishi UFJ Morgan Stanley Securities halted procedures such as identity verification [5]. Among railway companies, Keihan Holdings took its website down and Hanshin Electric Railway planned to do the same, while Sakura Internet, the online store builder BASE and a Ministry of Health, Labor and Welfare website listing long-term care providers nationwide also went offline or into emergency maintenance [5][8].

PHP is also built into some software products and network equipment, where users may not be able to tell whether it is in use [13]. The IPA has asked users to start by checking product manuals and the information published by developers and vendors [13].

References

  1. [1]PHP (Security advisory: Critical remote code execution vulnerabilities, update now)
  2. [2]Sankei News (プログラミング言語「PHP」の修正パッチ配布始まる「重大な欠陥」に相次ぐ緊急メンテ)
  3. [3]CERT-EU (Critical Vulnerabilities in PHP)
  4. [4]NCSC (Critical security issue affecting PHP)
  5. [5]Kyodo News (銀行決済は影響確認されず PHP 欠陥、鉄道などで緊急措置)
  6. [6]Wiz (PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet)
  7. [7]Kyodo News (プログラム言語 PHP に重大欠陥 ウェブ 7 割で使用、攻撃の恐れ)
  8. [8]Kyodo News (Vulnerabilities found in widely used PHP programming language)
  9. [9]GitHub (RCE via OOM corruption · Advisory · php/php-src)
  10. [10]PHP (PHP 8.5.12 Released!)
  11. [11]BBC (Websites taken down worldwide as critical PHP cyber-security update issued)
  12. [12]The Verge (A critical PHP vulnerability may take websites down today)
  13. [13]IPA (【事前準備のお願い】PHP のセキュリティリリース公開予定について)