Japan's PHP Security Shutdowns Reach 1,090 as Services Struggle to Reopen

Hundreds of services still await a return

Japan's response to two serious PHP security flaws has disrupted at least 1,090 websites and online services, with hundreds still lacking an announcement that they had reopened by October 26, 2026. The disruption has reached online shopping, financial account procedures, childcare services and games as operators install fixes and check whether their systems are safe to reconnect.

Assured, a Tokyo company that provides security assessment information for cloud services, counted 1,090 service suspensions as of 3 p.m. on October 26. Its analysis relied mainly on posts announcing shutdowns from official accounts on X. The total was up from 502 at 2 p.m. on October 23, an increase of 588, or about 117%, in roughly three days.

For 465 of those services, Assured had not confirmed a reopening announcement. That represents about 43% of the recorded suspensions. The figures track public announcements, so the latest status of those 465 services still requires confirmation from their operators.

Bandai Namco Holdings expected an online store selling toys and other goods to reopen at noon on October 27, after maintenance began on the evening of October 21. Online connections for arcade games including Taiko no Tatsujin remained suspended. At Daiwa Securities, some website functions had returned, while applications to open NISA investment accounts and procedures such as address changes remained unavailable at 5 p.m. on October 26.

What the PHP2shell flaws can do

Japan's Information technology Promotion Agency, known as IPA, identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619 in its October 22 PHP security alert. Their combination is called PHP2shell. PHP is software used to run many websites and web applications, handling work on servers before information reaches a user's browser.

CVE-2026-109618 concerns error handling when PHP runs out of memory. CVE-2026-109619 concerns the processing of requests sent to a server. Exploiting the flaws could allow a remote attacker to execute arbitrary code, meaning instructions chosen by the attacker rather than the website operator.

JPCERT/CC, Japan's computer security incident coordination body, says that code could run with the permissions of the PHP process. In plain language, an attacker could gain the ability to perform actions that the software running the website is allowed to perform. The reach would depend on the permissions and configuration of the affected system.

IPA says organisations should check information from the developers or providers of products they use, because PHP may be part of a larger application or service. JPCERT/CC also warns that PHP supplied through software products or Linux distributions may be affected, making vendor guidance part of the response.

How the shutdowns spread

Service operators began taking systems offline on October 21, before the security updates became available at around 11 p.m. Japan time. Some were acting in advance of the release, when public details of the weaknesses could increase the risk of attacks.

The sequence shows how an urgent software update became several days of disruption:

• October 21: BASE, Codmon, Pixiv, DMM.com, niconico and some Sakura Internet services entered maintenance or suspended functions. Games including Granblue Fantasy and Uma Musume Pretty Derby also stopped temporarily.
• October 21, 9:55 p.m.: Prime Minister Sanae Takaichi called for urgent preparations to apply the patches and said temporary website suspensions were an option when immediate installation was difficult.
• October 21, around 11 p.m.: PHP security updates were released.
• October 22: IPA and JPCERT/CC published alerts explaining the vulnerabilities and recommended responses.
• October 23: Assured's count reached 502 suspensions. PHP's developers also disclosed another vulnerability, CVE-2026-115560.
• October 26: Assured's total reached 1,090, while JPCERT/CC updated its warning with reports of attempted exploitation.
• October 27, noon: Bandai Namco expected its online store selling toys and other goods to reopen.

Why taking a website offline became an option

Japan's National Cybersecurity Office advised that temporarily suspending a website could reduce risk when operators could not promptly install the patch. Takaichi repeated that option in her October 21 appeal. CERT-EU and Britain's National Cyber Security Centre also urged action and raised taking systems offline until protections were in place as a possible response.

IPA's guidance sets out a sequence of choices. Organisations should first consider temporary protections and access restrictions while arranging an update or migration. If effective temporary measures are difficult, they should assess whether to block external access or suspend the service, taking potential damage and business disruption into account.

For customers, that choice meant losing access to everyday functions while operators worked. A shopping site could stop accepting orders, a financial website could suspend account procedures, and an arcade machine could lose its connection to online features.

Yasuhiro Suzuki, who led Assured's investigation, said operators were increasingly choosing to suspend services to protect customer information, while the slow return of services showed how difficult safe reopening could be. His assessment captures the central operational problem: closing access can be quick, but restoring it requires the underlying work to be completed.

A patch is only part of reopening

Bandai Namco's disruption illustrates why services within the same corporate group can return at different times. The group expected its merchandise store to reopen on October 27, while connections for arcade games remained suspended. Updates to systems needed for installing the PHP patch were taking time.

Some services were also considering temporarily moving data to another company's servers whose safety had been checked. That would change where the service operates while teams work on the affected environment, adding another set of preparations before customers can return.

Daiwa Securities had restored parts of its website, including frequently asked questions, but account applications and address changes were still unavailable on October 26. A functioning information page therefore coexisted with interrupted customer procedures.

IPA explains that systems left without updates for long periods may require changes to application code and checks that functions still work after PHP is updated. Missing development documents, absent staff with knowledge of the system and expired maintenance contracts can make the work harder. JPCERT/CC recommends sufficient testing followed by prompt installation of the corrected versions.

Which versions need attention?

IPA and JPCERT/CC identify four corrected PHP releases for the original pair of vulnerabilities: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Earlier releases within each of those branches are affected. Operators need to match the fix to the PHP branch used by their system and check guidance from their software or operating system provider.

Older installations present a further problem. IPA cites security company Wiz's finding that versions from PHP 5.4 onward are affected by at least one of the two vulnerabilities. PHP 8.1 and earlier have reached the end of support, meaning they no longer receive the normal maintenance available to supported releases.

IPA advises moving to supported PHP versions or to products and services with protections in place when a fix is unavailable. JPCERT/CC adds that PHP's developers have provided limited mitigation measures for PHP 7.4, 8.0 and 8.1 because of the seriousness of the vulnerabilities.

Temporary mitigation reduces exposure through particular attack routes. JPCERT/CC says updating is the remedy for the original vulnerabilities, so organisations using temporary settings still need to plan the software update or migration required for their systems.

Attack attempts add urgency

JPCERT/CC's October 26 update to its PHP vulnerability advisory says numerous pieces of demonstration code claiming to exploit the flaws had appeared. It also cites repeated reports of network traffic attempting exploitation.

Whether such code succeeds depends on factors including the PHP version, execution environment and arrangement of data in memory. JPCERT/CC warns that further attack methods and techniques targeting particular environments may emerge, and recommends both updating and investigating possible compromise.

Its investigation guidance includes checking for unusually long or oddly formatted PHPSESSID cookies, which carry information used to recognise a browser's session. Other warning signs include suspicious requests using multipart/form-data, a format commonly used for uploads, especially near memory limit errors or HTTP 500 errors indicating a server problem.

Unexpected crashes or frequent restarts of PHP worker processes are another item to examine. Workers are the processes that handle incoming tasks. JPCERT/CC also recommends checking for suspicious processes, external communications and newly created files, alongside continued monitoring. Where compromise is suspected, it advises preserving logs and other evidence, investigating the affected area and isolating systems as needed.

A third vulnerability requires a setting change

PHP's developers disclosed CVE-2026-115560 on October 23, adding another task during the response. JPCERT/CC says this vulnerability can allow arbitrary code execution under a particular combination of configuration settings and application code.

The developers described the affected configuration as uncommon and planned a fix through the normal release cycle. Until that release, JPCERT/CC relayed the recommendation to set session.upload_progress.enabled=0 and restart every worker process. Its October 26 update gave no release date for that fix.

The same setting had already been recommended as a mitigation for CVE-2026-109619. Operators that had applied it did not need to repeat that configuration step, according to the advisory. Teams still need to account for the original pair of vulnerabilities and this additional issue when checking their systems.

Some organisations face a larger decision

IPA's advice extends beyond the immediate repair. It asks organisations to examine the role a system still serves, how much it is used and whether another service could take its place. For software that has gone without maintenance, restoring service may require a decision about who will support it afterward.

Business managers and executives, as well as technical staff, should assess whether they can provide the people, budget and maintenance arrangements needed for an update or migration and continued operation, IPA says. Where that support is feasible, the agency recommends proceeding with the update or moving to a protected service.

Where continued maintenance cannot be arranged, IPA lists other options: moving to a product with support, reducing functions, ending public access or retiring the system. It also calls for plans to preserve or transfer necessary data and explain alternative arrangements to users.

The practical challenge now stretches from installing specific PHP releases to restoring individual customer functions. Bandai Namco's expected store reopening offers one scheduled step, while the 465 services without confirmed reopening announcements in Assured's count show how much public status checking remained on October 26.

Key Points

• Assured counted 1,090 service suspensions in Japan by 3 p.m. on October 26, up from 502 on October 23.
• Reopening announcements had not been confirmed for 465 services, about 43% of the total.
• The PHP2shell vulnerabilities can allow remote attackers to run code with the permissions of the PHP process.
• Corrected releases for the original two flaws are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• JPCERT/CC warned of published demonstration code and reports of attempted exploitation.
• A third vulnerability requires a temporary configuration change and the restart of all workers while a fix is prepared.
• Bandai Namco expected its merchandise store to reopen at noon on October 27; some arcade connections and Daiwa Securities procedures remained suspended on October 26.