[TECHNOLOGY] · Japan, Netherlands, United Kingdom, South Korea, France · 14 sources

started 3 days ago · updated about 21 hours ago

Part of situation: Global PHP security vulnerability impact (3 clusters)

PHP security vulnerabilities trigger global service disruptions

PHP vulnerability cybersecurity remote code execution CVE-2026-109618 service disruption

Critical security vulnerabilities in the PHP programming language, identified as CVE-2026-109618 and CVE-2026-109619, have prompted widespread emergency responses across Europe and Asia. The flaws, which carry a CVSS v4.0 score of 9.2, can allow remote code execution and memory corruption, potentially enabling attackers to take control of web servers.

In Japan, the impact has been significant due to the language's high usage rate. Major entities including Mitsubishi UFJ Financial Group, Nomura Financial Services, Japan Airlines, and Shizuoka Bank have suspended various online services as a precaution. SoftBank also temporarily disabled its emergency disaster alert system to conduct security maintenance. Government agencies, including the Ministry of Finance and the Japan Meteorological Agency, have also taken preventive measures.

In Europe, authorities in the Netherlands, France, Belgium, and the UK have issued warnings. The Wikimedia Foundation paused certain systems to manage the risk. Meanwhile, South Korea has raised its cybersecurity crisis alert level to ‘vigilance’. While many organizations have proactively taken systems offline, experts note that the immediate risk to individual households remains limited as most devices sit behind routers without public IP addresses.

Entities

All Nippon Airways · Bridgestone Cycle Co., Ltd. · Chugoku Electric Power Network · JR Bus Chugoku · Japan · Japan Airlines · Mitsubishi UFJ Financial Group · PHP · SoftBank · The PHP Group · Tokyo Mystery Circus · Wikimedia Foundation

Claims

What the coverage asserts, and how many sources carry each claim.

[○ 1 SOURCE] Tokyo Mystery Circus implemented emergency maintenance on its ticket system. mysterycircus.jp
[○ 1 SOURCE] The Japanese government is forming a special team to use AI to simulate cyberattacks. melliun.org
[○ 1 SOURCE] SoftBank suspended its emergency disaster alert service to address the vulnerability. zdnet.co.kr
[○ 1 SOURCE] Every Co., Ltd. suspended its 'Everyca' electronic money payment app. prtimes.jp
[● 3 SOURCES] Mitsubishi UFJ Financial Group and Nomura Financial Services suspended parts of their internet services. melliun.org · vtv.vn · baochinhphu.vn
[○ 1 SOURCE] Bridgestone Cycle suspended its online registration and inquiry systems. www.bscycle.co.jp
[● 14 SOURCES] A critical security vulnerability was discovered in the PHP programming language. www.j-shine.org · www.bscycle.co.jp · www.keibun.co.jp · melliun.org · activesleep.jp · +9 more
[○ 1 SOURCE] JR Bus Chugoku temporarily suspended its website as a preventive measure. www.fnn.jp
[○ 1 SOURCE] More than 90% of identifiable server-side websites in Japan use PHP. vtv.vn
[● 2 SOURCES] PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow remote code execution. nemesishd.gr · baochinhphu.vn
[○ 1 SOURCE] The Wikimedia Foundation paused some systems to handle the vulnerability. baochinhphu.vn
[○ 1 SOURCE] The PHP development team released security updates on October 21, 2026. nemesishd.gr