Key takeaways

  • The PHP project will release fixes for two critical vulnerabilities, each rated CVSS 9.2, at 14:00 UTC (23:00 in Japan) on October 21, 2026. Researchers call them "php2shell".
  • Details leaked before the patch. Security firms and CERT-EU say the flaws allow remote code execution, possibly without authentication, and may affect PHP 5 and later. PHP itself has not yet published affected versions, the cause or the attack path.
  • No exploitation had been reported as of the evening of October 21 in Japan.
  • Several Japanese services switched off before the patch as a precaution: Codmon, an app childcare centers use to communicate with parents, stopped all its services; the website builder Studio suspended its dashboard and editor; Sakura Internet stopped some functions.
  • In our view, pausing an internet-facing service until a critical fix is applied is a legitimate security decision, not a failure. It is the right call when a flaw is this serious, this widely deployed and already leaked.

What is known#
Official The PHP security team announced on October 20 a security release for two critical vulnerabilities, both CVSS v4.0 9.2, scheduled for 21 October, 14:00 UTC. It said it might release earlier if details went public or exploitation appeared. Affected and fixed versions will be published with the release
Japan IPA published a pre-alert on October 21 asking organizations to inventory where they use PHP and be ready to apply the fix quickly. It notes that PHP is also built into software products and network devices, and that some sites still run unsupported PHP
CVE numbers CVE-2026-109618 and CVE-2026-109619, according to CERT-EU and researchers. Not yet confirmed by PHP
Type Remote code execution, according to CERT-EU and watchTowr, which says it believes it has reproduced one of them
Affected versions Claims differ: PHP 5 and later (CERT-EU), 5.4 and later (Sansec). Not confirmed by PHP
Exploitation None seen as of October 21 by watchTowr, Huntress, Australia's ASD/ACSC or IPA. Material resembling proof-of-concept code is reported to be circulating

What is not known. PHP has not said which component is at fault or how an attacker reaches it. GMO Flatt Security, which was not part of the embargo, suspects PHP's session upload progress feature, but revised its advice the same day: switching that feature off may reduce the risk but is not expected to prevent an attack. There is no reliable workaround to rely on before the patch.

Japanese services that paused#

  • Codmon (コドモン), used by nurseries, kindergartens and after-school programs to run attendance and communicate with parents, stopped all its services, including the parents' app, on October 21 as a precaution, and expected to resume early on October 22. It said it had found no unauthorized access or data leak.
  • Studio, the website builder still dealing with a breach of its cloud environment, suspended its dashboard and editor from 22:00 on October 21, citing the PHP notice. Published websites stay online. It says no damage has been found.
  • Sakura Internet, one of Japan's largest hosting providers, stopped some functions in response, according to Nikkei.
  • Other system integrators and hosting customers have warned their users of possible short outages around 23:00 while they update.

Our analysis#

Pausing is a security control#

A flaw that lets anyone on the internet run code on a web server, in software that runs a large share of the web, with details already leaked and a patch hours away, is close to the worst case. The window between the release and mass exploitation of a flaw like this is now measured in hours, and in our recent coverage of AI tools on attackers' servers we saw how quickly a campaign can work through targets once it knows what to look for.

In our view, the services that switched off first made the right call. A planned outage of a few hours, announced in advance, has a known and limited cost. A compromised server holding children's records, or customers' data, does not. It is the same kind of decision the Japanese Red Cross made when it paused its blood donor app after NICT's warning, and the one we argued for in our analysis of app breaches: not running a system is a legitimate security control, not an admission of failure.

Deciding in advance makes it possible#

Pausing is not free. Codmon is how many childcare centers reach parents, and Studio's customers cannot edit their sites while it is down. That is exactly why the decision is best made before a night like this: which services can be switched off, who has the authority to do it, how users will be told, and what keeps working in the meantime. Organizations that have answered those questions can act on a pre-alert. Those that have not tend to wait for the patch, and hope.

The harder part comes after 23:00#

The patch will fix supported versions. Sites running old, unsupported PHP, which IPA says are still in use, may get no fix at all, and PHP inside products and appliances will be patched only when each vendor ships an update. For those systems, the choice may be between upgrading, isolating them, or keeping them switched off.

What this means for readers#

  • Inventory PHP tonight: web applications, CMSs such as WordPress, admin tools, and products or appliances that embed PHP. Note which versions you run.
  • Be ready to update at 23:00 JST (14:00 UTC), and decide now who will do it and when services will be restarted.
  • Decide whether to pause internet-facing PHP applications that you cannot patch promptly, and restrict access to admin interfaces in the meantime.
  • Plan for unsupported PHP versions: they may not receive a fix.
  • Watch your logs for unusual requests to PHP endpoints, especially file uploads, after the details are published.
  • Ask your vendors whether their products use PHP and when they will ship an update.

We will update this article when the PHP project publishes the release and its advisory.

Japanese terms at a glance#

Japanese Reading Meaning
脆弱性 zeijakusei Vulnerability
任意のコード実行 nin'i no kōdo jikkō Arbitrary code execution
セキュリティリリース sekyuriti rirīsu Security release
予防措置 yobō sochi Precautionary measure
緊急メンテナンス kinkyū mentenansu Emergency maintenance
棚卸し tanaoroshi Inventory (of systems)