Tokyo: Japanese Prime Minister Sanae Takaichi on Wednesday urged organisations to check whether their public-facing websites use PHP, a programming language widely used to run websites, after developers announced emergency security updates to address two critical cybersecurity vulnerabilities.
The warning comes amid reports of major websites worldwide, including in the US and Europe, going offline as operators race to protect their systems from potential cyberattacks.
In a post on X, PM Takaichi wrote, “We have an urgent request for everyone to take action tonight. Regarding PHP, which is used on many websites, the PHP security team has issued a warning about two critical vulnerabilities. Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight at 11 PM on October 21 (Japan time) as soon as possible.”
She said that if the security patch could not be applied promptly, organisations could consider temporarily suspending their websites to reduce risks.
“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk. Related information is also being posted on the X account of the National Center of Incident Readiness and Strategy for Cybersecurity, so please refer to that as well,” the Japanese Prime Minister added.
Similar warnings were issued in the US, where the Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) advised organisations using PHP to prepare for immediate security updates.
The FBI’s cyber division wrote on X, “Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.”
The FBI recommended that organisations take affected systems offline if immediate updates were not feasible.
It also urged organisations to report any signs of compromise, isolate affected systems and preserve web server and PHP logs.
“Those reports help us identify the actors involved and warn other organizations before they become victims,” the bureau said, directing organisations to their local FBI field office or the Internet Crime Complaint Center at ic3.gov.
The NSA also advised organisations using PHP to prepare for security updates addressing the two critical vulnerabilities.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance,” the agency said.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, reportedly stem from memory management issues and stale internal state that may persist across requests. These weaknesses could potentially allow attackers to execute malicious code on vulnerable servers, posing risks to sensitive information and network security.
Disclaimer : This story is auto aggregated by a computer programme and has not been created or edited by DOWNTHENEWS. Publisher: deccanchronicle.com
