From our other sites
The story
The PHP development team announced on October 21, 2026 that it will release a patch fixing two critical vulnerabilities at 11:00 PM Japan time. Japan’s National Cyber Unit responded on its official X (formerly Twitter) account with a warning of its own, urging operators of public-facing websites to check whether they’re running PHP and to be ready to apply the patch the moment it drops. Around the time of the announcement, a string of web services began going into maintenance one after another, and 5ch threads buzzed with comments like “once the patch is out, attack code will get auto-generated from the diff,” along with debate over how everyone would cope once 11pm hit.
National Cyber Unit (Alerts & Warnings) @cyber_forecast
1:01 PM · October 21, 2026
PHP’s security team has issued a warning about two critical vulnerabilities. Please check whether your public-facing website uses PHP, and be ready to apply the fix patch — set for release at 11:00 PM Japan time on October 21 — as quickly as possible.
Source: x.com / original post here
What people said
The Digital Agency's whole job is pushing digital transformation to cut labor costs — security was never really their department.
And here I thought they were the 'My Number Card Agency' (a nickname mocking the Digital Agency for fixating on Japan's national ID card system over, you know, actual security)
Yep. The second the new version drops, AI will generate attack code straight from the diff against the old version. If you don't take your service offline before release, you're toast.
That publisher that puts out all those cheesy self-help paperbacks (a joke mixing up the programming language with PHP Institute, an unrelated Japanese publishing house)
PHP: Hypertext Preprocessor
In math, it's short for the pigeonhole principle
The ones that actually posted a maintenance notice are such a relief.
But this is Japan.
Who knows how this'll actually go.
"Who's the admin here?! We've got an urgent issue with our company's web server!"
The boss: "I'm out wining and dining clients right now. Ugh — fine, here, I'll just give you the password."
"Protect your own information yourself" — Digital Minister Furukawa
www.jiji.com/jc/article?k=2026100600559
Click the wrong banner ad and you might get bounced straight to a site that's already been compromised.
PHP drama is just par for the course at this point.
Re: #40
Isn't 5ch running on Perl anyway?
Re: #54
Hiroshi Abe's site is hand-written raw HTML.
So it's completely unaffected.
The US and Europe are getting hit way harder than Japan on this one, so it's not really a Japan-policy issue specifically.
Honestly we'd have been better off never going digital at all. Switch back to phone and fax.
↓
That exposes the "answer key" to the whole world — exactly where the hole was (the vulnerability itself).
↓
AI reverse-engineers it within minutes and starts mass-hunting every unpatched server that hasn't updated yet.
↓
Game over.
Surely the official team has already accounted for that risk? Isn't that a bit too obvious to miss?
No matter how well the official side handles it, it's whoever's actually applying the patch that's the weak link…
I asked an AI about it — apparently even after PHP officially announces the fix, distros like RHEL still take several hours to verify the patch before pushing it to their repos.
Sorry, that's us too lol
The AI was saying that on anything below PHP 8, you might need to modify your own code just to get it running again after the patch.
Oh no…
What do I even do. Took it offline with no recovery timeline for now, and honestly there's no real ETA in sight.
Once it hits 11pm I'll be handling maybe 10 cases or so. Haven't heard a peep from the clients though.
Whoa, a frontline defender right here in the thread. Good luck out there!
The AI said that even once PHP announces at 11pm, it probably won't show up in the repos right away.
Guess it depends on whether you're pulling updates through the kernel-side packages or something like the Remi repo.
Your response time is way too slow lmaooo
Though realistically, most companies are probably exactly like this.
Stop shaking and just handle it now.
11pm is just when the patch gets released — isn't the actually dangerous part right now, before it's even out???
The logic is: once the patch is released, the diff reveals exactly where the weak spot is, which means cyberattacks ramp up. Though honestly it's probably already bad right now too.
Because once the patch drops, you can tell exactly where the security hole was.
Yep. It's already bad — that's why services everywhere are shutting down.
What are you talking about, they're doing the whole PHP thing, you know, THAT thing.
Them being down right now just means they're taking it offline as a precaution until the patch drops.
If anything, the sites that AREN'T down right now are the scary ones.
Background and Key Points of This Topic
PHP underpins a huge share of the world’s websites and content management systems, so releasing a patch for a critical vulnerability has wide-reaching consequences. The thread’s recurring claim that “attacks ramp up once the patch is out” reflects a well-known general mechanism: comparing the code before and after a fix can reveal exactly where the weakness was, making unpatched servers easy targets. At the same time, it’s a common misconception that a released patch means instant safety — in practice, distributions like RHEL and repositories like Remi can take several hours to verify and roll out a fix, and environments running below PHP 8 may need separate code changes of their own. It’s also worth flagging that specific claims in the thread, like “AI can generate attack code within minutes,” are speculation based on posters asking an AI chatbot, not anything confirmed by an official announcement.
*This article is compiled as an excerpt/summary of the 5ch (News Flash+) thread “National Cyber Unit: ‘Critical PHP vulnerability found — please prepare to apply the fix patch releasing at 11:00 PM on October 21 as soon as possible’.”
Leave a Reply