Sakura Internet suspended part of its cloud service on Wednesday after the disclosure of two critical vulnerabilities in PHP, the widely used server-side scripting language. Later the same day, Japanese Prime Minister Sanae Takaichi publicly urged website operators to apply the incoming patch that night or temporarily take their sites offline.

Sakura withdraws database web tools with no restart date

In a notice published at 1:22 p.m. Japan time on October 21, Sakura Internet said it was withdrawing the web interface tools from its Database Appliance service. The affected tools are phpMyAdmin, phpPgAdmin and pgAdmin, the browser-based consoles administrators commonly use for day-to-day management of MariaDB and PostgreSQL databases.

The company's Database Cluster service remains online. Sakura did not announce a date for restoring the suspended features, and in the interim it advised customers to use SQL clients compatible with MariaDB and PostgreSQL. The company apologized to customers for the interruption.

Cygames and pixiv also declared emergency maintenance in response to the PHP flaws. PHP underpins large portions of e-commerce and other web applications, and that shared dependence is what turned one upstream disclosure into same-night emergency maintenance at companies in unrelated industries.

Prime Minister points operators to the 11 p.m. fix

Takaichi's appeal was posted on X at 9:55 p.m. Japan time. She described it as a very pressing request for action that night and asked operators to verify whether their public websites were using PHP. She told them to prepare to roll out the patch, due at 11 p. Japan time, and wrote that temporarily taking a website offline was one way to reduce risk if quick patching proved difficult.

She also directed followers to the National Cybersecurity Office's account on X. At 10:57 p.m., the office said the updates had been released and urged users to install them as soon as possible, warning that unpatched sites could be breached. By Thursday, Takaichi's post had drawn more than 308,000 likes and roughly 78,000 reposts.

Two 9.2-severity flaws dubbed "PHP2Shell"

Fixed versions are PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 and PHP 8.5.12. According to Cryptopolitan, details of the flaws leaked, prompting PHP's maintainers to ship the fixes a day earlier than planned. The two vulnerabilities, dubbed "PHP2Shell" and tracked as CVE-2026-109618 and CVE-2026-109619, each received a severity score of 9.2 out of 10 and could allow attackers to execute code on unpatched servers.

The first bug exploits how PHP handles out-of-memory conditions. The second exploits request state that persists after its memory has been freed.

According to the PHP project's advisory, all installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project ranks mod_php as the riskiest configuration, and a demonstrated exploit fires before any application code runs. Linux distributors and long-term-support vendors shipped the patches in advance.

The PHP project no longer issues updates for PHP 8.1 and below, though its security team released minimal source backports for PHP 7.4, 8.0 and 8.1.

About 70% of all websites whose server-side language is known run on PHP. Japan, the EU, the US, Germany, Australia and the UK also issued warnings. Finland, the Netherlands and France took government websites offline as a precaution, and Nintendo pulled services in order to patch. With Sakura offering no restart date for its Database Appliance web tools and the fixed versions only hours old, the near-term signals to watch are a restoration announcement from Sakura and further guidance from the National Cybersecurity Office as operators complete their rollouts.