The fallout from the critical PHP flaws known as PHP2Shell was still spreading on 26 October 2026, with Japan counting 1,090 service suspensions and security firms reporting a flood of probing attacks. The episode has become a test of how quickly website operators can patch software that sits behind a large share of the web.

Japan's count keeps rising

Tokyo-based security assessment firm Assured counted 1,090 suspensions in Japan by 3 p.m. on 26 October, up from 502 on 23 October. For 465 of those services, about 43%, no reopening announcement had been confirmed. The disruption touched shopping, financial account procedures, childcare services and games, including a Bandai Namco store expected to reopen on 27 October and some Daiwa Securities procedures still unavailable.

Millions of attempts, not millions of breaches

Cloudflare reported tens of thousands of exploit attempts within 45 minutes of public disclosure, rising to millions in the following days. That distinction matters: an attempt is a probe, not proof of a successful break-in. Even so, Japan's JPCERT/CC warned on 26 October of published demonstration code and repeated reports of traffic attempting exploitation.

What operators must do

The original flaws, CVE-2026-109618 and CVE-2026-109619, can let a remote attacker run code with the permissions of the PHP process. Corrected releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. US agencies including the FBI urged immediate patching, or taking systems offline where patching was not yet possible. A third flaw disclosed on 23 October also needs a temporary setting change and a restart of all workers until a fix is ready.

Source: Asia Daily