[CLSTR]
< Back to situation

[REVISION HISTORY]

Global PHP security vulnerability impact

Updated 4 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-25 08:53 UTC → 2026-10-26 18:06 UTC · added removed

A critical security vulnerability in the PHP programming language has triggered widespread service disruptions across multiple countries. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2 and can allow remote code execution and memory corruption, potentially enabling attackers to take control of web servers. In Bangladesh, several financial and government institutions suspended their websites as a precaution. Affected entities include Bangladesh Bank and six commercial banks: Agrani Bank, Janata Bank, IFIC Bank, Standard Islami Bank, SBAC Bank, and Bengal Commercial Bank. While officials noted that internet and mobile banking remained functional, the Ministry of Land suspended its digital land services portal for maintenance following an urgent alert from the BGD e-GOV CIRT cyber security agency. The National Cyber Emergency Response Team (CIRT) has issued warnings to government and private organizations to patch outdated PHP versions, identifying vulnerabilities known as ‘PHP2Shell’ that could allow unauthorized remote code execution, potentially leading to data exposure or server compromise. Following a three-day shutdown intended to mitigate cyberattack risks, the Bangladesh Bank website was restored on the morning of October 25 after a thorough risk assessment. Spokesperson Arif Hossain Khan confirmed the site became operational at 8:00 am. Other affected institutions, including Agrani Bank, IFIC Bank, Standard Islami Bank, SBAC Bank, Janata Bank, and Bengal Commercial Bank, also experienced temporary outages. The government’s Aspire to Innovate (a2i) project noted that approximately 36,500 websites under the National Portal Framework are not at direct risk as they do not use PHP. In Japan, the impact has been significant due to the language’s high usage rate. Major entities including Mitsubishi UFJ Financial Group, Nomura Financial Services, Japan Airlines, and Shizuoka Bank have suspended various online services. SoftBank also temporarily disabled its emergency disaster alert system to conduct security maintenance. The Japanese government has urged immediate patching and announced the formation of a special team to use artificial intelligence to simulate cyberattacks.

Versions

  1. 2026-10-26 18:06 UTC Global PHP security vulnerability impact
  2. 2026-10-25 08:53 UTC Global PHP security vulnerability impact
  3. 2026-10-25 05:56 UTC Global PHP security vulnerability impact
  4. 2026-10-25 03:43 UTC Global PHP security vulnerability impact
  5. 2026-10-24 08:21 UTC Global PHP security vulnerability impact

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.