# Global PHP security vulnerability impact

> Live situation record from CLSTR: https://clstr.news/situations/global-php-security-vulnerability-impact
> Updated: 2026-10-24T18:05:13.000Z. Sources: 21. Developments: 3.

A critical security vulnerability in the PHP programming language has triggered widespread service disruptions across multiple countries. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2 and can allow remote code execution and memory corruption, potentially enabling attackers to take control of web servers. 

In Bangladesh, several financial and government institutions suspended their websites as a precaution. Affected entities include Bangladesh Bank and six commercial banks: Agrani Bank, Janata Bank, IFIC Bank, Standard Islami Bank, SBAC Bank, and Bengal Commercial Bank. While officials noted that internet and mobile banking remained functional, the Ministry of Land suspended its digital land services portal for maintenance following an urgent alert from the BGD e-GOV CIRT cyber security agency. 

The National Cyber Emergency Response Team (CIRT) has issued warnings to government and private organizations to patch outdated PHP versions, identifying vulnerabilities known as ‘PHP2Shell’ that could allow unauthorized remote code execution, potentially leading to data exposure or server compromise. Following a three-day shutdown intended to mitigate cyberattack risks, the Bangladesh Bank website was restored on the morning of October 25 after a thorough risk assessment. Spokesperson Arif Hossain Khan confirmed the site became operational at 8:00 am. Other affected institutions, including Agrani Bank, IFIC Bank, Standard Islami Bank, SBAC Bank, Janata Bank, and Bengal Commercial Bank, also experienced temporary outages. 

In Japan, the impact has been significant due to the language’s high usage rate. Major entities including Mitsubishi UFJ Financial Group, Nomura Financial Services, Japan Airlines, and Shizuoka Bank have suspended various online services. SoftBank also temporarily disabled its emergency disaster alert system to conduct security maintenance. The Japanese government has urged immediate patching and announced the formation of a special team to use artificial intelligence to simulate cyberattacks.

## Claims

- A critical security vulnerability was discovered in the PHP programming language. (corroborated by 14 sources)
- Mitsubishi UFJ Financial Group and Nomura Financial Services suspended parts of their internet services. (corroborated by 3 sources)
- PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow remote code execution. (corroborated by 2 sources)
- The vulnerabilities have a CVSS v4.0 score of 9.2. (corroborated by 2 sources)
- The website was taken offline to prevent potential cyber attacks related to PHP programming language vulnerabilities. (corroborated by 2 sources)
- SoftBank suspended its emergency disaster alert service to address the vulnerability. (single source)
- The Japanese government is forming a special team to use AI to simulate cyberattacks. (single source)
- Every Co., Ltd. suspended its 'Everyca' electronic money payment app. (single source)
- Bridgestone Cycle suspended its online registration and inquiry systems. (single source)
- JR Bus Chugoku temporarily suspended its website as a preventive measure. (single source)
- Tokyo Mystery Circus implemented emergency maintenance on its ticket system. (single source)
- Japan Airlines and Shizuoka Bank suspended online services due to the vulnerabilities. (single source)

## Timeline

### 2026-10-24: Bangladesh banks face cyber security risks as websites go offline

Bangladesh's central bank and several commercial banks have faced website outages due to cyber security risks linked to PHP programming language vulnerabilities.

6 sources. https://clstr.news/cluster/bangladesh-bank-website-restored-after-security-concerns

### 2026-10-23: PHP security vulnerabilities trigger global service disruptions

Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have caused global service disruptions, forcing major banks, airlines, and government agencies in Japan and Europe to suspend online operations

14 sources. https://clstr.news/cluster/japanese-companies-suspend-services-due-to-php-vulnerability

### 2026-10-22: Bangladesh Bank and several institutions offline due to PHP vulnerability

Bangladesh Bank, six commercial banks, and the government's land services portal have disabled their websites to protect against cyber risks stemming from a global PHP programming language vulnerability.

4 sources. https://clstr.news/cluster/bangladesh-banks-and-government-portal-offline-due-to-php-vulnerability

---
Cite as: Global PHP security vulnerability impact. CLSTR, https://clstr.news/situations/global-php-security-vulnerability-impact