Asian governments raise cyber defenses as PHP flaws prompt service shutdowns

Asian governments stepped up cybersecurity measures on Thursday, October 22, after the disclosure of critical flaws in PHP, a programming language used by websites worldwide. China urged inspections and upgrades, South Korea raised its private-sector cyber alert, and services in Japan were suspended while organizations worked to protect their systems, Reuters reported.

The PHP development team released urgent fixes on Wednesday and encouraged users to update immediately, according to Reuters. The response followed the shutdown of government websites in Europe and elsewhere as operators worked to patch the flaws. The Guardian reported that websites worldwide had been taken offline over the preceding day while governments and businesses addressed the vulnerabilities.

How China, South Korea and Japan responded

In Japan, Mitsubishi UFJ Financial Group said it was temporarily suspending some internet services as an emergency measure. The Finance Ministry suspended some website content and online services while implementing security measures, Reuters reported. These interruptions show how the effort to protect systems can affect people trying to use online banking and government services.

What the PHP flaws could allow

MercoPress identified the two vulnerabilities as CVE-2026-109618 and CVE-2026-109619 and reported a severity score of 9.2 out of 10. The Straits Times, in a Reuters-sourced explainer, reported that the rating reflects the possibility of an attacker running commands on a vulnerable server over the internet without an account or password. MercoPress said fixes were available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Cloudflare chief executive Matthew Prince said in a Wednesday post that his company had seen thousands of attempts to exploit the flaws in the 10 hours before their public announcement, tens of thousands within 45 minutes afterward, hundreds of thousands within two hours and millions by the time he posted, Reuters reported. Those figures are Prince’s account of observed attempts. MercoPress reported attack attempts but said security firms had not confirmed a successful exploit.

Security firms recommended patching immediately or taking systems offline where an immediate patch was not possible, The Guardian reported. Don Smith, a vice-president of threat intelligence at Sophos Counter Threat Unit, told The Guardian that organizations also face the task of finding and managing every instance where PHP is running.