The key facts
- Two critical PHP vulnerabilities discovered — CVE-2026-109618 and CVE-2026-109619, allowing unauthenticated remote code execution
- Japan's Ministry of Health, Labour and Welfare, BASE, Tokyo University of Foreign Studies and Sakura Internet suspended or restricted services
- NSA and FBI called for immediate updates; OpenAI said its models helped find the vulnerabilities under the Patch the Planet initiative
Service suspensions in Japan
On Wednesday, October 21, 2026, Japan suspended the operation of a number of websites, including government services, after critical vulnerabilities were discovered in the widely used programming language PHP, the Kyodo news agency reported. The Ministry of Health, Labour and Welfare, as a precaution, temporarily shut down the website of its information disclosure system. The e-commerce service BASE launched emergency maintenance, Tokyo University of Foreign Studies ordered an urgent inspection of web servers, and the company Sakura Internet suspended some service functions.
The nature of the vulnerabilities
PHP developers on Wednesday urged users to immediately install security updates after the identification of two critical vulnerabilities that allow attackers to remotely execute malicious code. Patched versions have been released; the developers warned that attacks are possible without authentication. In its guidance, the PHP team stated that all installations processing web requests are potentially at risk. The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619 and are related to memory handling errors and stale internal states persisting between requests.
US authorities' response
The US National Security Agency (NSA) urged organizations using PHP to prepare for immediate updates, warning that the vulnerabilities could give attackers direct access to a server's file system or databases. “These vulnerabilities often provide a direct path to a server's file system or database. If immediate updating is not possible, it is recommended to take the system offline until the threat is fully addressed,” the agency's statement said, promising more detailed guidance. The FBI's cyber division urged urgently updating affected PHP installations, conducting an inventory of systems running PHP with priority attention to internet-facing servers and third-party products, and monitoring for suspicious activity — for example, unexpected shell launches by PHP processes or file downloads.
Reactions in Japan and Australia
Japan's National Cyber Security Agency urged users to install security patches. “We are closely monitoring the situation,” a government spokesperson said. Australia's Signals Directorate recommended that organizations and individuals monitor their PHP applications and prepare to install updates.
OpenAI's role and the scale of the problem
OpenAI said its models helped researchers discover the vulnerabilities under the Patch the Planet initiative, which brought together developers, researchers and security solution vendors to prepare fixes before public disclosure. According to the company, preparation took two months because fixing the vulnerabilities required a complex change to the PHP engine. PHP is widely used across the internet: by OpenAI's estimate, it powers about 70% of websites, so unpatched systems may present significant opportunities for attackers.
