[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

3 clusters · 21 sources · 3 days · First seen · Last updated

Global PHP security vulnerability impact

Overview

A critical security vulnerability in the PHP programming language has triggered widespread service disruptions across multiple countries. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2 and can allow remote code execution and memory corruption, potentially enabling attackers to take control of web servers.

In Bangladesh, several financial and government institutions suspended their websites as a precaution. Affected entities include Bangladesh Bank and six commercial banks: Agrani Bank, Janata Bank, IFIC Bank, Standard Islami Bank, SBAC Bank, and Bengal Commercial Bank. While officials noted that internet and mobile banking remained functional, the Ministry of Land suspended its digital land services portal for maintenance following an urgent alert from the BGD e-GOV CIRT cyber security agency.

The National Cyber Emergency Response Team (CIRT) has issued warnings to government and private organizations to patch outdated PHP versions, identifying vulnerabilities known as ‘PHP2Shell’ that could allow unauthorized remote code execution, potentially leading to data exposure or server compromise. Following a three-day shutdown intended to mitigate cyberattack risks, the Bangladesh Bank website was restored on the morning of October 25 after a thorough risk assessment. Spokesperson Arif Hossain Khan confirmed the site became operational at 8:00 am. Other affected institutions, including Agrani Bank, IFIC Bank, Standard Islami Bank, SBAC Bank, Janata Bank, and Bengal Commercial Bank, also experienced temporary outages.

In Japan, the impact has been significant due to the language’s high usage rate. Major entities including Mitsubishi UFJ Financial Group, Nomura Financial Services, Japan Airlines, and Shizuoka Bank have suspended various online services. SoftBank also temporarily disabled its emergency disaster alert system to conduct security maintenance. The Japanese government has urged immediate patching and announced the formation of a special team to use artificial intelligence to simulate cyberattacks.

Entities

Janata Bank · Bangladesh Bank · PHP · The PHP Group · Ministry of Land

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 6 sources
    Bangladesh banks face cyber security risks as websites go offline

    Bangladesh's central bank and several commercial banks have faced website outages due to cyber security risks linked to PHP programming language vulnerabilities.

  2. [TECHNOLOGY] 14 sources
    PHP security vulnerabilities trigger global service disruptions

    Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have caused global service disruptions, forcing major banks, airlines, and government agencies in Japan and Europe to suspend online operations

  3. [TECHNOLOGY] 4 sources
    Bangladesh Bank and several institutions offline due to PHP vulnerability

    Bangladesh Bank, six commercial banks, and the government's land services portal have disabled their websites to protect against cyber risks stemming from a global PHP programming language vulnerability.

Sources

activesleep.jp · ajkerpatrika.com · baochinhphu.vn · bscycle.co.jp · deshebideshe.com · en.prothomalo.com · fnn.jp · fukuishimbun.co.jp · j-shine.org · keibun.co.jp · melliun.org · mysterycircus.jp · nemesishd.gr · pieria24.gr · prtimes.jp · sangbad.net · sarabangla.net · terra.com.pe · tob.news · vtv.vn · zdnet.co.kr

This summary has been updated 4 times: see revision history