NSA Cyber

Japan's Prime Minister Sanae Takaichi just urged everyone to act on the PHP flaws tonight. Here's what you need to know. Takaichi posted an urgent request on X. She asked people to check whether their public websites use PHP, and to be ready to apply the fix patch as soon as it came out. The release was set for 11 PM Japan time on October 21. If patching is hard, she said temporarily suspending sites can reduce risk. The post passed 71M views, with about 98K reposts and 327K likes. The flaws are CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution with no login needed. They come from memory handling, where longjmp() error handling leaves memory pointing at freed data. PHP is estimated to run about 70% of websites. Japan's National Center of Incident Readiness and Strategy for Cybersecurity later confirmed the update was out and told sites to apply it fast. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU urges updating to one of them. Sources put the severity at CVSS 9.2. Other agencies followed. The NSA told organizations using PHP to prepare for the update. The FBI Cyber Division named both CVEs and warned of remote code execution in PHP core. The fallout spread fast: - pixiv ran emergency maintenance from 7 PM on October 21 into October 22 - Umamusume's maintenance start was moved to 1 PM UTC - Internet Archive went offline - PancakeSwap said it doesn't use PHP and isn't affected - OpenAI said its models helped researchers find the flaws under its Patch the Planet initiative. Readers' notes say an independent researcher found and built an exploit months earlier In Japan, engineers said the Prime Minister's post made it easier to get management to approve urgent patching. Node.js also shipped its own security releases the same day for 22.x, 24.x and 26.x. Key numbers: - 71M views on Takaichi's post - 2 critical flaws, CVSS 9.2 - 4 patched PHP versions - About 70% of websites run PHP The patch is live, and officials say to apply it now or take exposed sites offline.