Update PHP or Go Offline: Japan PM and FBI Issue Urgent Cybersecurity Warning
Major cybersecurity flaws in PHP trigger urgent warnings from Japan's PM, FBI, and NSA. Learn why websites are going dark to prevent hacking.
A global cybersecurity alert has sent shockwaves through the digital world, with the Prime Minister of Japan, the FBI, and the NSA all issuing urgent warnings to organizations worldwide. The crisis centers on critical vulnerabilities in PHP cybersecurity update requirements, a programming language that powers a vast portion of the internet's websites and web applications. The situation has become so dire that major websites across the US and Europe have already gone offline as operators race to secure their systems against potential hackers.
Japan's Prime Minister Urges Immediate Action
Japanese Prime Minister Sanae Takaichi took to X (formerly Twitter) to issue a stark warning to all organizations. She urged them to immediately verify if their public-facing websites utilize PHP and to prepare for emergency security patches.
The Prime Minister emphasized that the PHP security team identified two critical vulnerabilities that required immediate attention. She specifically pointed to a fix patch released at 11 PM on October 21 (Japan time) and urged users to apply it as soon as possible.
"If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," PM Takaichi stated, directing organizations to the National Center of Incident Readiness and Strategy for Cybersecurity for further alerts.
FBI and NSA Sound the Alarm in the US
The urgency is mirrored in the United States, where the FBI's cyber division and the National Security Agency (NSA) have issued their own advisories. The FBI identified two specific vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which could be catastrophic if exploited.
According to the FBI, these flaws could allow malicious cyber actors to remotely execute code within the PHP core. Such an attack could lead to the compromise of sensitive networks and the theft of private data. The Bureau's advice was clear: if an immediate update is not possible, organizations should take their systems offline entirely until the threat is mitigated.
The NSA's Stance on System Risk
The NSA, the US government's cybersecurity arm, echoed this sentiment, noting that PHP vulnerabilities often provide hackers with a direct path to a server's database or file system. The agency advised all organizations using PHP to be prepared for immediate updates, stating that taking systems offline is the only safe alternative when a patch cannot be applied instantly.
What Exactly is the Flaw?
The technical root of the problem lies in how PHP manages memory. Developers have discovered that issues with memory management and a "stale internal state" that persists across different requests can be exploited. This loophole potentially enables attackers to run malicious code on any server running the vulnerable version of the language.
Steps for Affected Organizations
For those managing websites, the FBI has provided a specific protocol for organizations that suspect they have already been compromised:
- Isolate: Immediately disconnect affected systems from the network.
- Preserve: Save and protect all web server and PHP logs for forensic analysis.
- Report: Notify the local FBI field office or report the incident via http://ic3.gov.
Authorities emphasize that reporting these incidents is crucial, as it helps security agencies identify the actors involved and warn other potential victims before they are targeted.