← Back to home

Home › Security news › Japan urged everyone to update PHP: here is how we checked our sites

Security news

Japan urged everyone to update PHP: here is how we checked our sites

October 26, 2026 · By the Páginas Clover team

In short: on October 21, 2026, Japan's prime minister, Sanae Takaichi, urged companies to apply the fix for two serious flaws in PHP, the language that powers a huge number of websites, ours included. On October 26 we checked every site we look after, one by one: all 6 already run PHP 8.4.27, the fixed version.

What happened

The PHP team announced two critical flaws, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). They let someone run code on a website's server without any username or password. The details leaked before the fix was out, and attack attempts had already been seen.

On October 21 the fixed versions came out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. That same day the US cybersecurity agency (CISA) asked everyone to update immediately and, if that wasn't possible, to take PHP systems offline until they were fixed.

That night, Japan's prime minister posted an urgent request on X: check whether your sites use PHP, be ready to apply the fix as soon as it came out and, if it couldn't be applied quickly, consider pausing the site for a while. On October 23 she announced that the government will strengthen cybersecurity with the National Cybersecurity Office as its command center, after several personal data leaks caused by attacks. On October 26 she led a ministerial meeting on cybersecurity.

What we did

On October 26 we checked, site by site in the server panel, which PHP version each one runs, and we ran our live security check again. The fixed version was already installed on all of them:

SitePHP versionStatus
paginasclover.comPHP 8.4.27✓ Fixed version
spanishwithemi.comPHP 8.4.27✓ Fixed version
prestamosclover.comPHP 8.4.27✓ Fixed version
oxidados.comPHP 8.4.27✓ Fixed version
And 2 more sites we look afterPHP 8.4.27✓ Fixed version

No site had to be paused. If any had been on an old version, the next step was to update it and, in the meantime, protect it as the official notices ask.

Our plan for every security alert

The websites with Páginas Clover support are in our care. Every time a serious alert comes out, we follow these steps:

  1. We follow the official notices: the teams that maintain the software, the US cybersecurity agency (CISA), and each country's cybersecurity centers.
  2. We check, one by one, every site we look after: which version it runs and whether the problem affects it.
  3. If an update is missing, we apply it. If it can't be applied right away, we protect the site as the official notices recommend, even pausing it until the fix is in place.
  4. We check security again on each live site.
  5. We report it here, with sources and dates.

Sources