Japan Scrambles to Patch PHP Flaws as Banks, Airlines Go Offline

All websites and backend services using PHP must be patched immediately or taken offline to prevent remote code execution attacks.

A critical security vulnerability affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619, has prompted urgent action from the UK's National Cyber Security Centre (NCSC). The flaw allows attackers to potentially execute commands on web servers running PHP by triggering an out-of-memory condition that leads to memory corruption. This corruption can be exploited for unauthenticated remote code execution. While PHP has released a security update to address the issue, the NCSC is strongly advising all organizations using any version of PHP to identify affected systems, prioritize internet-facing ones, and apply the necessary updates. For those unable to update immediately, temporary mitigations are available, with the recommendation to take systems offline if mitigation is not feasible.

The pervasive nature of PHP in web development means this vulnerability poses a widespread threat, impacting a vast number of organizations that may not have immediate visibility into all their PHP deployments. The NCSC's alert underscores the critical need for continuous monitoring of third-party software and bundled components, as PHP is often integrated into appliances and services, complicating patch management. Organizations must accelerate their vulnerability management processes to address this critical flaw promptly.

This incident highlights the ongoing challenge of securing legacy and widely adopted technologies in the face of sophisticated cyber threats. The potential for unauthenticated remote code execution necessitates a swift and thorough response from system administrators worldwide, potentially leading to significant operational disruptions for those unable to patch quickly. The NCSC's advice to take systems offline if patching or mitigation is not feasible suggests a high confidence in the exploitability of the vulnerability.