Ministry of Digital Affairs warns of PHP vulnerabilities: Taiwan website services urged to patch promptly; major vulnerabilities also disclosed in Java and Node.js

Ministry of Digital Affairs warns of PHP vulnerabilities: Taiwan website services urged to update promptly
The Cyber Security Administration of the Ministry of Digital Affairs issued a major cybersecurity alert today (10/22), noting that the official security team for PHP—a programming language widely used by websites and online systems around the world—released emergency updates on the evening of October 21 to patch two critical vulnerabilities. Government agencies, schools, and private companies using PHP are strongly urged to update to the latest version as soon as possible.
Meanwhile, Oracle's Java platform and the open-source Node.js project also disclosed multiple high-risk remote attack vulnerabilities on the 21st. All service platforms using these technology stacks should take note.
PHP vulnerabilities score 9.2, could allow remote code execution
The Cyber Security Administration said the two critical vulnerabilities disclosed in PHP are CVE-2026-109618 and CVE-2026-109619. Both received a score of 9.2, classified as critical, under the CVSS v4.0 vulnerability scoring standard.
These two vulnerabilities allow remote attackers to send malicious requests from outside and execute arbitrary code on target hosts without any authentication. They could easily lead to the exposure of highly sensitive data, or even allow malicious outsiders to take complete control of an entire server.
The Cyber Security Administration noted that widely used content management systems (CMS), including WordPress, Drupal, Joomla, and Magento, rely heavily on PHP as their underlying framework, making the scope of impact extremely broad.
The official patched versions—8.5.12, 8.4.27, 8.3.36, and 8.2.35—are now available. All organizations should conduct a thorough inventory and upgrade as soon as possible.
Image source: Ministry of Digital Affairs. Ministry of Digital Affairs warns of PHP vulnerability: Taiwan’s web services should update as soon as possible
The first to discover the PHP vulnerability was an independent researcher, not AI
Regarding how the vulnerability was discovered, OpenAI claimed that the security research team Calif used GPT-5.6 Sol to identify the critical flaw. Calif later clarified, however, that the vulnerability was first discovered and a proof-of-concept (PoC) exploit developed by independent security researcher LCFR, who had already posted a warning on social media on August 5. AI tools were involved only in subsequent verification.
The PHP Foundation also admitted that the core development team had noticed related anomalies during an external security audit as early as 2024, but internal decision-making delays postponed remediation. Work to fix the vulnerability was not assigned the highest priority until this August.
Related report: Major PHP vulnerability discovered: numerous websites and mobile games suddenly undergo maintenance; OpenAI claims GPT helped find it
High-risk vulnerabilities disclosed in Java and Node.js as well
In addition to PHP, Oracle issued an important security alert, reporting a high-risk vulnerability in the JSSE component, CVE-2026-91403, with a CVSS v3.1 base score of 9.1.
The vulnerability is low complexity to exploit. Attackers need no privileges and can send malicious data over a network connection to a specific API without authentication, causing untrusted malicious code to be loaded and executed. Even environments relying on the Java sandbox for protection are affected. Impacted versions include Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1, and the GraalVM series.
Oracle stressed that patches are available only for versions still under support. Older versions no longer supported by the vendor also face significant security risks, and customers are strongly urged to plan system upgrades as soon as possible.
Meanwhile, the Node.js project patched 10 vulnerabilities across the 22.x, 24.x, and 26.x release lines, including four high-risk issues. These include CVE-2026-111497, where an out-of-bounds write in the Brotli decoder could lead to remote code execution, as well as two TLS certificate validation bypass vulnerabilities. Patched versions v22.23.4, v24.22.1, and v26.12.1 are now available for download.
Java vulnerability disclosure and patched version downloads
Node.js vulnerability disclosure and patched version downloads
In addition to updating, websites and services of all kinds should promptly review logs
With patches for three core internet technologies released on the same day, website and service providers should not only upgrade immediately, but also thoroughly review system logs and records of unusual access after completing the updates.
The PHP Foundation also recommended that organizations with large internal system architectures that cannot update packages immediately consider isolating affected internet-facing services during the transition period. This would help guard against potential zero-day attacks and protect the safe operation of critical network infrastructure.
The article “Ministry of Digital Affairs warns of PHP vulnerability: Taiwan’s web services should patch as soon as possible; major vulnerabilities also disclosed in Java and Node.js” was first published on “Crypto City”