|
Japanese Prime Minister Sanae Takaichi on Wednesday urged organisations to check if their public websites were using PHP, a programming language that runs websites, as their developers released emergency security updates to fix critical cybersecurity flaws.
The warning comes amid major websites worldwide, including in the US and Europe, going offline as operators race to protect systems from hackers. In a post on X, PM Takaichi wrote,"We have an urgent request for everyone to take action tonight. Regarding PHP, which is used on many websites, the PHP security team has issued a warning about two critical vulnerabilities. Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight at 11 PM on October 21 (Japan time) as soon as possible." She said if there is an issue with fixing the patch promptly, then temporary suspension of websites can be considered. "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk. Related information is also being posted on the X account of the National Center of Incident Readiness and Strategy for Cybersecurity, so please refer to that as well. National Center of Incident Readiness and Strategy for Cybersecurity (Notice and Alert Information)," Japan PM added. Similar warnings were issued in the US, with the NSA and FBI issuing advisories. FBI cyber division wrote on X, "Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks." If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated, Bureau added. FBI urged organisations to report any signs of compromise. "Isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or http://ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims," it said. US National Security Agency, a cybersecurity arm, also stated that organizations must take the system offline if immediate update is not feasible. "Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance," it said. The developers have identified the vulnerabilities -- CVE-2026-109618 and CVE-2026-109619. The vulnerabilities stem from memory management issues and stale internal state that may persist across requests, potentially enabling attackers to execute malicious code on vulnerable servers. (ANI)
|
