PHP security warnings issued over two critical vulnerabilities
Based on JVN and JPCERT/CC warnings published on October 22. PHP fixes were released on October 21; this does not mean every website suffered a newly confirmed attack on October 22.
IllustrationTwo PHP vulnerabilities could allow code to run on a server. Japanese security organizations issued warnings on October 22, following the release of fixes on the evening of October 21. Website operators need to check their environments and update.
Read for 8 seconds to inform recommendations.Reading history & counting settings
Based on JVN and JPCERT/CC warnings published on October 22. PHP fixes were released on October 21; this does not mean every website suffered a newly confirmed attack on October 22.
Warnings concern code execution on servers
JVN identified CVE-2026-109618 and CVE-2026-109619 as vulnerabilities that could allow arbitrary code execution on a server. PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators should check the fixed release for the PHP branch they use.
Updating website content is different from updating PHP
PHP runs on the server. Editing articles or updating only website management features does not update PHP itself. Hosting customers should check their provider's notices and response; operators managing their own environments should follow official security guidance.
Sources & further reading
Our own summary based on the public information below.
- JVN：PHPにおける複数の任意のコードが実行可能な脆弱性 ↗Source publication date: 2026-10-22
- JPCERT/CC：PHPの脆弱性に関する注意喚起 ↗Source publication date: 2026-10-22
- PHP：2026年の公式リリース記録 ↗
This is a record of information available at publication. Later reports may change the details. Check the source for current weather, safety and market information.
