> JapanHacked_
[Ongoing][Severity: Moderate][Web app exploit]

php2shell: critical flaws in PHP

Details of two critical flaws in PHP leaked before the fix, and ministries, local governments, banks and companies across Japan paused websites and services as a precaution.

Every organization listed paused its services as a precaution; none is listed as hit.

Disclosed

2026-10-21

Organizations involved

608

Leaked or at risk

Unknown

Downtime

Unknown

The flaws

Two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) can allow unauthenticated remote code execution on the server. [1] [2]

What happened

Details of the flaws leaked before the fix was released.

  1. Before the fix, BASE, CoDMON, pixiv, DMM.com, niconico and others in Japan paused their services as a precaution. [3]

  2. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (about 23:00 JST). [1]

Calls to act and exploitation

The National Cyber Office and Prime Minister Takaichi called a temporary stop an effective measure. [3]

Cloudflare reports millions of exploitation attempts. [6]

Sites and services paused in Japan

The impact spread nationwide; organizations like these paused websites or some services as a precaution.

Timeline

  1. Disclosed 2026-10-21
  2. 1 days

Attack or cause

Method
[Web app exploit]
Impact
[Service outage]
Entry point
Web app

Data exposed or at risk

–

Services hit

Organizations involved

  • [Precautionary halt][Moderate]Hiroshima, Hiroshima, NakaPrefecture

    Hiroshima Prefecture

    Stopped the DoboX landslide portal at 21:00 on 21 October and the Hiroshima road navigation site at 11:00 on the 22nd.

  • [Precautionary halt][Moderate]Ibaraki, MitoPolice

    Ibaraki Prefectural Police

    Stopped its chat-based emergency report service for people with hearing or speech impairments as a precaution and pointed users to the National Police Agency 110 app.

  • [Precautionary halt][Moderate]Iwate, MoriokaPrefecture

    Iwate Prefecture

    Ran emergency maintenance on its website and some features became unavailable. The Iwate Mobile Mail service for disaster and public notices also paused some messages from 9:30 on 22 October.

  • [Precautionary halt][Moderate]Tokyo, ChiyodaInformation and communications

    NTT DOCOMO, Inc.

    Stopped part of its Area Mail emergency alerts and its Dokodemo disaster and evacuation information service for security work, and later resumed them. Nikkei reported this was a response to the PHP flaw.

  • [Precautionary halt][Moderate]Tokyo, MinatoInformation and communications

    SoftBank Corp.

    Paused some sites and services on 22 October. For the PHP fix, it stopped its emergency alert mail from 06:47 on 23 October and resumed earthquake early warnings and tsunami warnings at 09:25 on 25 October. Disaster and evacuation alerts from national and local governments were to stay stopped until maintenance finished on 26 October.

  • [Precautionary halt][Moderate]Aomori, AomoriFinance and insurance

    Aomori Michinoku Bank, Ltd.

    Stopped some services, such as its personal banking app, on the night of 21 October.

  • [Precautionary halt][Moderate]Tokyo, ItabashiMunicipality

    Itabashi City

    Stopped part of its disaster emails, its e-library, school websites and more, with some still stopped on 26 October.

  • [Precautionary halt][Moderate]Saitama, KasukabeMunicipality

    Kasukabe City

    Briefly stopped its inquiry forms, safety information emails, school services and more. As of 23 October, its foreign-language translation, My Number card application support and a childcare support site were still stopped.

  • [Precautionary halt][Moderate]Tokyo, KokubunjiMunicipality

    Kokubunji City

    For the PHP fix, stopped its disaster app, My Number Card application support, the website feedback form and other services.

  • [Precautionary halt][Moderate]Tokyo, ChiyodaInformation and communications

    LIFULL Co., Ltd.

    Ran emergency maintenance from 20:00 on 21 October and brought LIFULL HOME'S and its other main services and sites back on the 23rd. It says no unauthorized access or leak has been found.

Open in organization search

Sources

  1. [1][Official]Security advisory: Critical remote code execution vulnerabilities, update nowThe PHP Group · 2026-10-21
  2. [2][Regulator]PHPの脆弱性対策について(CVE-2026-109618、CVE-2026-109619：PHP2shell)IPA · 2026-10-22
  3. [3][News]多くのサイトが予防的に公開停止、高市総理が対応呼びかけ―「PHPの深刻な脆弱性」対応で何が起きた？INTERNET Watch · 2026-10-22
  4. [4][News]プログラム言語「PHP」重大弱点 さくらネット、対応で機能一部停止Nikkei · 2026-10-21
  5. [5][Official]【重要】10月21日(水) 22:00からの緊急メンテナンスのお知らせSTUDIO · 2026-10-21
  6. [6][News]PHP「緊急」脆弱性悪用の試み、数百万件に CloudflareのCEOが報告ITmedia NEWS · 2026-10-22
  7. [7][Official]PHP脆弱性情報を受けた一部サービスの利用停止についてThe Yamanashi Chuo Bank · 2026-10-21
  8. [8][Official]プログラミング言語「PHP」の脆弱性への対応についてau Jibun Bank · 2026-10-22
  9. [9][Official]PHPに関するセキュリティ上の安全確保を目的とした当行一部サービスの利用状況についてThe Chugoku Bank · 2026-10-22
  10. [10][Official]【一部復旧】ＰＨＰ脆弱性情報を受けた一部サービスの利用停止についてThe Kagoshima Bank · 2026-10-22