KR — 전자신문

China and Japan Governments Urge Swift Response to PHP Vulnerability, Citing Japan's Heavy Reliance on PHP

SecurityOctober 22, 20261 min read

A serious security flaw was found in PHP, a programming language used to build many websites. China and Japan's governments have warned users to update quickly, and many Japanese websites, banks, and public offices have had to pause some services.

What happened

A critical security weakness was found in PHP, a common tool for making websites. Governments in China and Japan issued warnings and asked people to install fixes right away. In Japan, several government sites, city and prefecture sites, a major bank, and other companies paused some services to fix the problem. Some European governments shut down their websites as a precaution.

Key numbers and facts

About 75% of websites that show their server language use PHP, according to the web analysis firm W3Techs.
WordPress has about 83.1% of the content-management-system market among Japanese-language websites that use one.
China's NVDB found two very high-risk flaws that let an attacker run code remotely without logging in.
Japan's Prime Minister Sanae Takaichi called the problem 'very urgent' on X (formerly Twitter).

Background

PHP is a programming language. Programmers use it to build home pages, online shops, message boards, and admin pages. WordPress is a popular website-building tool that runs on PHP. Because so many sites depend on the same language, one flaw can affect a huge number of sites at once.

Why it matters

The flaw could let hackers take control of servers, steal private data, or shut down services. Japan relies heavily on PHP, so the problem caused large disruptions there, including for bank customers and people renewing driver's licenses. Users and website owners need to update quickly to stay safe.

What to watch

Whether affected services come back online after the fixes are applied.
Whether more governments or companies pause their websites.
Whether attacks using the flaw are reported.

Glossary

PHP: A programming language used to build many websites, such as online shops and message boards.
WordPress: A popular website-building tool that runs on PHP.
NVDB: China's government platform that shares information about internet security threats and weak spots.
W3Techs: A web analysis company that tracks which technologies websites use.

Same story, different eyes

The EngineerAI

One patch, thousands of sites: why PHP updates are so hard to roll out fast

From an engineer's view, the tricky part isn't writing the fix, it's getting it everywhere at once. PHP sits underneath WordPress, shops, and admin pages, so each site has to check its plugins and versions, apply the patch, and test before going live. That's probably why some services were paused first and reopened afterward. How quickly smaller sites without a dedicated team will catch up is not yet known.

The RegulatorAI

One PHP bug showed how differently governments handle shared software risk

What I find interesting is that Japan's prime minister posting on X, China's NVDB issuing a bulletin, and European agencies simply taking sites offline are three quite different ways of answering the same flaw. It suggests software dependency is becoming something governments manage directly, much like infrastructure, even though there's no common rulebook for it yet. Japan's heavy reliance on WordPress seems to have turned a technical patch into a public-service continuity question. How each country will formalize patch duties for public and private sites is not yet known.

The UserAI

One PHP patch shows how much of everyday life runs on a single tool

Looking at this as a working professional, the part that stands out is how ordinary the disruption was: booking a branch visit, renewing a license, opening a fund account. If your company runs a WordPress site or any PHP-based admin page, the most useful thing to do now is ask your IT or web vendor which PHP version you're on and whether the patch has gone in. Sites that have already updated should feel back to normal fairly soon, but services that were paused for checks may take a bit longer to fully return. How long each organization needs to finish its inspections hasn't been shared yet.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.