Threat Pulse 62High
Japan's IPA and cyber office issue PHP2Shell alert; JPCERT publishes compromise indicators
Severity 5PatchedconfirmedGovernmentWeb servers and gateways

Japan's Information-technology Promotion Agency issued a PHP2Shell warning on October 22, relayed by the National Cybersecurity Office, and JPCERT/CC published three indicators of compromise plus emergency steps, noting the unusual patches for end-of-life PHP 7.4 to 8.1 and a December 31, 2026 deadline to move off 8.2.

What to do: Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; check JPCERT indicators.

· 14 days ago · all PHP operators in Japan · @IT (ITmedia)
Sources@IT (ITmedia)piyolog
On X
@cyber_forecastunverified

2026年10月22日、PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619：PHP2shell）に関する件として、IPAが注意喚起をしています。

Open on X
Why this score

National advisory covering millions of Japanese PHP sites (impact 3), exploitation attempts under way (exploitability 2), government advisory (criticality 0).

Back to the board

Updated Nov 5, 01:45 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.