Japan suspends several websites over critical PHP security vulnerabilities

Japan suspended several websites, including government services, Wednesday after critical vulnerabilities were discovered in the widely used PHP programming language, according to Kyodo news agency.

The Health, Labor and Welfare Ministry temporarily suspended a website for its information disclosure system as a precaution, the news agency reported.

Online store service BASE also launched emergency maintenance, while Tokyo University of Foreign Studies ordered an urgent inspection of its web servers.

Sakura Internet Inc. suspended some service functions in response to the security concerns.

Japan's National Cybersecurity Office urged users to install security patches. "We are closely monitoring the situation," a government official said.

Australia's Signals Directorate also advised organizations and individuals to monitor their PHP applications and prepare to apply updates.

Developers warn of remote code execution risks

PHP developers urged users Wednesday to install security updates immediately after identifying two critical vulnerabilities that could allow attackers to execute malicious code remotely.

The developers released patched versions and warned that attackers could exploit the flaws without authentication.

In a security advisory, the PHP team said all installations handling web requests were potentially at risk.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involve memory-handling errors and outdated internal states that can persist between requests.

The flaws could allow attackers to execute malicious code on affected servers.

PHP is used extensively across the internet, meaning unpatched systems could present significant opportunities for attackers.