The latest PHP vulnerability is so severe that crime-fighting organizations and world leaders are issuing warnings.
Japanese Prime Minister Sanae Takaichi made a rare direct appeal to businesses on X on the evening of October 21, 2026, urging organizations running PHP-based websites to prepare for an emergency patch — and to consider temporarily taking sites offline if they couldn’t apply it fast enough.
“We have an urgent request for everyone to take action tonight,” Takaichi wrote, in a post that had drawn more than 23 million views within hours. She asked companies to check whether their public-facing websites run on PHP and to be ready to apply the fix the PHP security team was set to release at 11 PM Japan time that night. If applying the patch quickly wasn’t feasible, she said, “temporarily suspending websites and similar measures can be considered an effective way to reduce risk.” She also pointed readers to Japan’s National Center of Incident Readiness and Strategy for Cybersecurity for further updates.
It’s an unusually technical intervention from a sitting head of government — normally the kind of guidance that comes from a national cybersecurity agency, not a prime minister’s own social media account.
FBI’s Cyber Division (@FBICyberDiv) account posted similar guidance on X, naming the two vulnerabilities by their CVE identifiers and recommending that organizations unable to patch immediately “take the system offline until it can be fully mitigated.” The post also advised inventorying where PHP runs across an organization’s environment, prioritizing internet-facing systems, watching for PHP processes spawning unexpected command shells, and reporting any signs of compromise to a local FBI field office or ic3.gov, alongside pointers to a CERT-EU advisory and CISA’s Known Exploited Vulnerabilities catalog. We have not been able to independently confirm this post came from an official FBI-run account, so it’s worth treating the attribution with some caution pending confirmation from the Bureau or a news outlet that has verified it directly.
Why it mattered enough to reach the PM’s desk
The urgency traces back to two critical vulnerabilities the PHP security team had been racing to fix. Both sit in core parts of the PHP engine — memory management and error handling — that touch nearly every request a PHP application processes, and both were confirmed capable of full remote code execution on real-world configurations. The PHP Foundation rated them 9.2 on the CVSS scale and pushed out patches (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) after technical details began leaking online two days ahead of the original planned release.
PHP still powers a large share of the world’s websites — by some estimates, around 70% — including government services, e-commerce platforms, banks, and media outlets, which is likely why the Japanese government treated this as a national-level risk rather than a routine software update. Takayuki Sugiura of the Japan Hacker Association separately warned that attackers exploiting the flaw could take over servers outright, stealing, encrypting, or destroying data.
Companies took the warning seriously
In the hours following the Prime Minister’s post, some Japanese companies reportedly took the precaution of suspending their web services entirely while waiting for the official patch to roll out, rather than risk running exposed, unpatched infrastructure. Market watchers also expect a near-term bump in demand for security auditing, monitoring tools, and emergency incident response as organizations scramble to confirm their exposure and confirm patches are properly applied.
The episode underscores just how central aging, widely deployed software like PHP still is to the modern internet — and how a single, deeply rooted bug in it can escalate from a developer mailing list to warnings from a head of government and (purportedly) a national law enforcement agency within the space of a day.