The night the Prime Minister called for "urgent" action.
On the evening of October 21, many companies and shops in Japan suddenly stopped their services or sites. According to a tally by the security blog "piyolog," 54 organizations announced shutdowns or emergency maintenance by 10 PM that day.
At 9:55 PM the same night, Prime Minister Sanae Takaichi posted on X: "An urgent request I need you to address tonight." The cause was a critical flaw found in PHP.
https://x.com/takaichi_sanae/status/2112890642590564386
"What is PHP?" "Does my homepage matter?" "Who do I ask for help?"
News articles are full of jargon like patches, remote code execution, and CVSS. Many people are left wondering what their company actually needs to do.
This article explains everything from scratch using a restaurant analogy, avoiding technical terms as much as possible so even a middle schooler can understand.
We will cover three things:
- What happened on October 21 and why it required a Prime Ministerial call to action
- How to check if your site is affected in 5 minutes via the admin panel
- What to do today, what NOT to do, and a ready-to-send inquiry template
Let's begin.
Chapter 1: On October 21, Critical PHP Flaws Were Disclosed
PHP is the programming language powering websites worldwide. Two serious flaws were found in PHP itself. These flaws are gaps that allow bad actors to intrude; news calls them "vulnerabilities."
August: Security Firm Finds Flaws
Researchers at overseas security firms discovered them. Wiz, one such firm, stated on its blog that AI helped find the first flaw. The PHP development team began preparing fixes after receiving reports.
October 20: Information Leaks
Originally, disclosure was planned after fixes were ready. However, on the 20th, posts appeared on overseas forums saying "PHP has two critical flaws," spreading the news.
The official PHP site predicted an emergency fix release for "11 PM JST on the 21st," noting it could be moved up if details leaked or exploitation occurred.
Oct 21 Day-Night: Companies Brace
IPA (Information-technology Promotion Agency) issued warnings urging preparation, stating no attacks had been confirmed yet.
Hosting providers acted too. Xserver paused admin panels from 4 PM as "preventive safety measures," clarifying user servers remained active with no unauthorized access. Lolipop! entered preventive maintenance ahead of the 11 PM fix.
The National Cyber Command Office posted three times on X: 1) Check if you use PHP; 2) Temporarily stopping sites is effective if immediate fixes aren't possible; 3) Followed by the PM's post.
Oct 21 ~11 PM: Fixes Released
The PHP team released four fixed versions:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Immediately after, the National Cyber Command Office urged updating to these versions "as soon as possible."
Use these numbers in Chapter 4 to compare with your version.
Next, let's explain PHP using a restaurant analogy.
Chapter 2: PHP is the "Kitchen Staff" of Your Website Restaurant
Imagine a website as a restaurant.
Customers opening the site is like entering and ordering. The kitchen staff prepares and serves dishes upon order—this is PHP.
For example, selecting dates on a reservation page shows availability; submitting a contact form displays confirmation. PHP handles this dynamic content generation for most sites.
Servers are the building and kitchen equipment—the computers hosting and running site data.
WordPress is "Recipes and Interior Decor"
Many stumble here. WordPress, common for corporate sites, is like recipes and decor. These recipes assume PHP kitchen staff will cook them. Thus, WordPress sites cannot run without PHP.
Hosting Providers are "Landlords of Shops with Kitchens"
Most SME sites run on rented servers. These are like shop rentals including kitchen equipment and staff.
Usually, the landlord updates the kitchen staff. But if you manage your own server or outsource entirely, you or your agency must handle fixes.
Key Point: This flaw is in the kitchen staff (PHP), not the recipes (WordPress) or decor.
Therefore, updating WordPress won't fix it. WordPress.org explicitly states no update is needed. You must fix PHP.
Chapter 3: The Flaw is a "Cleanup Mistake" in the Kitchen
Two flaws exist. Here they are translated into kitchen analogies based on official descriptions.
Flaw 1: Treating Half-Cooked Dishes as Finished During Cleanup
Staff prep dishes on counters. If space runs low, they pause mid-prep.
The problem arises during cleanup: cleaners mistake half-cooked plates for finished ones. Memory is counter space. Official docs describe memory shortages causing interrupted processing where cleanup routines mishandle incomplete data.
Flaw 2: Reusing Previous Customer's Order Notes for Next Customer
Staff handle orders sequentially. Old notes should be discarded before new ones.
However, sometimes the note is gone but the record remains. New cooking uses this stale info. Official docs describe residual memory info from previous processes being used incorrectly by subsequent tasks.
Exploitation Leads to Kitchen Takeover
Both involve mistaking unusable items for usable ones. Exploiting this confusion allows outsiders to control the kitchen staff.
Official PHP statement:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.
Meaning: Fixes address flaws allowing unlogged-in outsiders to execute programs remotely.
Why So Serious?
Three reasons:
Reason 1: Anyone Can Try
No password/login needed. Any internet user can attempt exploitation.
Reason 2: Severity Score 9.2/10
Global standard rates both as "Critical" (9.2). PHP notes attacks may bypass site logic entirely depending on configuration.
Reason 3: Attackers Target Immediately After Fix Release
Fixes reveal vulnerability locations. Sansec predicted mass attacks within 15 minutes of release. Hence the urgency.
Are Attacks Happening?
- Cloudflare observed attack traffic targeting customers, with attackers varying payloads to evade defenses.
- watchTowr reported attempted exploitation for both flaws.
- Huntress noted no actual exploitation among its clients as of 11 PM Oct 21.
As of early Oct 22, IPA's warning remains latest. JPCERT hasn't listed PHP yet. CISA's KEV catalog doesn't include them.
Attacks are starting, but no confirmed domestic takeovers yet.
Don't panic, but don't wait. Check your status next.
Chapter 4: Check Your Status in 5 Minutes via Admin Panel
Two checks: Do you use PHP? Which version?
Method 1: WordPress Site Health
If using WordPress, you use PHP. Check version:
- Login to WP Admin
- Tools > Site Health
- Info tab > Server
- Look for "PHP Version"
You'll see e.g., "8.3.30". Ask your manager/agency if you don't access admin.
Method 2: Hosting Control Panel
For non-WP or separate systems:
Sakura Internet: Script Settings > Language Version > PHP Version
ConoHa WING: Site Management > Site Settings > App Settings > PHP Settings > PHP Version
Xserver: PHP Ver. Switch (Note: Panel down until late Oct 22 due to maintenance)
Lolipop!: Server Management > PHP Settings (User page down until late Oct 22)
Method 3: Compare with Fixed Versions
Format: Major.Minor.Patch (e.g., 8.4.27 = 8.4 series, 27th patch).
- "8.4.26": Not fixed (needs 8.4.27)
- "8.3.36": Fixed
- "8.1", "7.4": No official fixes available. See Ch 6.
Don't rely solely on numbers. Some hosts backport fixes. Trust host announcements if they say "patched."
Hidden PHP Locations
Old sites often have outdated PHP. Check:
- Reservation/contact forms
- E-commerce/member pages
- Internal HR/order systems
- Abandoned campaign sites
- Outsourced sites with unknown internals
IPA urges auditing all PHP usage. Start with public-facing sites.
Chapter 5: Today's Task: Clarify "Who Fixes It"
CEOs don't fix servers. They decide who does and when.
Pattern 1: Rented Server -> Read Host Announcements
Hosts usually update PHP. Check provider notices.
Kagoya Japan plans auto-updates for 8.2-8.5 plans. Xserver applies official/custom patches. Actions vary by plan/provider.
Pattern 2: Outsourced -> Contact Agency Today
Send this template:
Subject: Inquiry re: PHP Vulnerability (php2shell) Response Status
Dear [Name], Regarding PHP security fixes released Oct 21 (8.5.12/8.4.27/8.3.36/8.2.35), please confirm status for our sites/systems: 1. Scope: All PHP-based assets (homepage, forms, etc.) 2. Current PHP Version 3. Update Status & ETA if pending 4. Handling for PHP <8.1 5. Responsibility split (Your firm vs Us)
Please notify us upon completion. Urgent request, thank you.
Question 5 prevents miscommunication about responsibility.
Pattern 3: Use AI to Summarize Host Notices
Paste notice into ChatGPT/Claude:
Paste rental server notice re: php2shell. Explain simply: 1. What host does 2. What we must do (or None) 3. Deadline/checkpoints Do not guess missing info.
Verify AI output against original text. AI assists; CEO decides.
Option: Stop Site if Immediate Fix Impossible
National Cyber Command suggests temporary shutdown reduces risk. CERT-EU recommends disconnecting exposed systems. Only CEOs can make this call.
Chapter 6: Four Things NOT To Do
Benevolent actions can increase risk.
NG1: Manually Change PHP Settings Based on Online Guides
Official docs state workarounds are insufficient:
There are no complete mitigations, updating is the only safe choice.
GMO Flatt Security confirmed some settings can be bypassed. Leave config changes to pros.
NG2: Updating WordPress/Plugins and Feeling Safe
Flaw is in PHP, not WP. Cloudflare confirms plugin/site updates don't fix it.
NG3: Relying Solely on WAF/Firewalls
Cloudflare added rules automatically. Their CTO noted these are stopgaps. Attackers evade WAFs. PHP update is still mandatory.
NG4: Ignoring Old Versions (<8.2)
No official fixes for pre-8.2. Upgrade or seek vendor support.
Also, 8.2 support ends Dec 31, 2026. Plan upgrades now to avoid future issues.
Summary: Fix the Kitchen Staff, Decide Who Does It
The flaw is in PHP (kitchen staff), allowing unauthenticated takeover. Urgency stems from immediate exploitability post-fix release.
CEOs need not touch servers. Ensure clarity on:
- Is PHP used?
- Who fixes it?
- When?
Start by sending the Chapter 5 template to your agency/host. Once resolved, document responsibilities for future incidents.
AI evolves fast. Learning from practitioners beats solo research.
Thank you for reading.
【Open Chat for Professionals Leveraging AI & X】
🎁 Join Benefits 🎁
■ AI Work Starter Kit
① 200 Prompts
② 20 Gems
③ 7 Claude Skills
Beginners welcome! Just browse!
↓ Join Here.
【📣 Announcement 2 📣】
Launched AI Advisory Service for Business Owners.
【Services】
・SNS Automation (X, Threads, IG, TikTok, YouTube)
・AI Employee Construction
・AI Tool/App Development
Customized to maximize sales.
