Skip to content
Japan Issues Warning Over Critical PHP Vulnerabilities Affecting Government Sites

Japan Issues Warning Over Critical PHP Vulnerabilities Affecting Government Sites

First seen 24 Oct 2026, 23:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 24, 2026 at 23:42 UTC

Japanese Prime Minister Sanae Takaichi announced critical vulnerabilities in the PHP programming language, widely used on government and commercial websites. The vulnerabilities, CVE-2026-109619 and CVE-2026-109618, both rated CVSS 9.2, were disclosed on October 21, 2026, with proof-of-concept code for CVE-2026-109618 released on October 23. In response, the government temporarily suspended some website functions to mitigate risks while urging users to apply patches as soon as they were available. The vulnerabilities affect numerous systems, particularly those running outdated versions of PHP. Major companies like Sakura Internet Inc. have already taken steps to address these issues by suspending some cloud service functions. The situation remains critical as the patching process is underway, and the potential for exploitation is high.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-21
PHP vulnerabilities disclosed
CVE-2026-109619 and CVE-2026-109618 were published, both rated CVSS 9.2, indicating critical vulnerabilities.
Nippon.com
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-23
Proof-of-concept code released
First public proof-of-concept for CVE-2026-109618 was made available, raising concerns about potential exploitation.
Japantoday
2026-10-24
Government sites partially suspended
The Japanese government announced the suspension of some website functions to address the PHP vulnerabilities.
Nippon.com

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

What are the CVEs associated with this vulnerability?
The vulnerabilities are CVE-2026-109619 and CVE-2026-109618, both rated CVSS 9.2.
What actions are being taken by the government?
The government has temporarily suspended some website functions and urged users to apply patches immediately.
Is there a risk of exploitation?
Yes, with proof-of-concept code now public, there is a significant risk of exploitation.