PHP published a security advisory on Oct. 21 to fix two critical vulnerabilities that could allow remote code execution without authentication, and called on all PHP users to update immediately.
Japanese Prime Minister Sanae Takaichi posted on X later the same day, using the heading of an urgent request, and asked website operators to confirm whether their services use PHP and apply the patch as soon as it became available that night. She added that if patching could not be done in time, temporarily suspending a website was also an effective way to reduce risk.
Takaichi wrote: 「Please address this urgent request tonight. Regarding PHP, which is used by many websites, the PHP security team has issued an alert over two critical vulnerabilities.」
Both flaws could lead to unauthenticated remote code execution
According to the PHP advisory, the patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The first issue, CVE-2026-109618, affects the handling path for out-of-memory conditions. PHP may be interrupted when request data has been only partially initialized, and later cleanup may treat invalid data as if it were valid.
The second issue, CVE-2026-109619, involves internal request state that remains after memory has already been freed. When the same worker process handles the next request, it may reuse that stale state.
PHP said Linux distributions and long-term support providers had received the fixes in advance, and users can check with their vendors for updated packages.
Source-level patches were also prepared for older branches
Versions before PHP 8.1 are no longer updated by the project in the normal course. Still, because of the severity of the flaws, the PHP security team also prepared source-level patches for PHP 7.4, 8.0 and 8.1 for users who compile from source or do not have a long-term support vendor.
PHP says configuration changes only reduce part of the risk
For users unable to update right away, PHP listed several temporary configuration changes. For the first flaw, it suggested setting memory_limit to unlimited and lowering post_max_size. For the second, it suggested disabling session.upload_progress.enabled and restarting all worker processes.
The project said those steps only reduce exposure for specific attack paths and do not make a system safe, adding that 「updating is the only safe choice.」
PHP also warned that users relying on the volunteer-maintained repository rpms.remirepo.net would not receive updates that day, and recommended using distribution packages instead or compiling from source.
Takaichi pointed operators to notices from Japan's NCO
Takaichi said in her post at 9:55 p.m. Japan time on Oct. 21 that the patch was scheduled to be released at 11 p.m. Japan time, or 10 p.m. in Taiwan. She also asked operators to refer to related notices from the alert and warning account of Japan's National Cyber Office, or NCO.
According to October data from web technology survey site W3Techs, 69.3% of websites with an identifiable server-side programming language use PHP, and 65.2% of them use PHP 8. Common website systems including WordPress are also written in PHP, so site administrators can first verify the PHP version on their hosts and then update based on vendor or official guidance.