We checked this claim: is it true that

JPCERT/CC updated its PHP advisory to warn of rising active attacks and added vulnerability CVE-2026-115560?

Confirmed

JPCERT/CC updated its advisory on October 26 after finding active attack probes, public exploit tools, and an added flaw tracked as CVE-2026-115560

Tech & AI

Japan cyber agency warns of rising web attacks

JPCERT/CC updated its PHP alert after attackers began using public tools against exposed servers.

Published
NRB — News Republic Brigade

The story continues

In a nutshell

Japan's cybersecurity agency elevated its warning for web servers running PHP after online attackers began weaponizing publicly shared exploit scripts against live systems. The agency maintained its initial patching guidance but expanded its alert to include a related security flaw, urging administrators to audit their networks immediately for active intrusions.

Highlights

  • JPCERT/CC first instructed administrators on October 22 to apply vendor patches and configuration fixes for CVE-2026-109618 and CVE-2026-109619.
  • The agency revised its alert on October 26 after tracking active network probes using publicly circulated proof-of-concept exploit tools.
  • The updated guidance added flaw CVE-2026-115560, widening the known attack surface for unpatched deployments.
  • Defenders must inspect server logs for evidence of active compromise rather than relying solely on future patching.

From the Editor’s Diary

When theoretical software flaws turn into circulating public attack tools, defense must shift immediately from routine patching to active compromise audits.

Who's involved

  • JPCERT/CC

    Japan's national computer emergency response coordination center

    goal → Protect network infrastructure by delivering timely vulnerability warnings and defense guidance

  • PHP Development Team

    The open-source programming group maintaining the PHP web language engine

    goal → Issue software patches that block unauthorized remote code execution

  • Web Infrastructure Administrators

    Corporate and public-sector technical teams managing PHP servers

    goal → Safeguard network assets by applying official fixes before attackers strike

In short

Corporate servers face immediate break-ins rather than theoretical flaws after internet attackers weaponized public tools against systems running PHP, the software engine powering much of the global web. The shift turns a standard maintenance chore into an urgent defense emergency for system operators.

Unpatched organizations face break-ins unless administrators inspect their system logs immediately to see if intruders already bypassed early defenses.

That outcome is likely because attackers are already probing exposed setups with publicly shared exploit methods, making quick intrusion attempts easy to automate.

Previously in this story

How it unfolded

01

JPCERT Updates Exploitation Notice

2026-10-26 – 2026-10-26

JPCERT/CC issued a formal alert update across official channels and social media on October 26 to report active attacks against online systems.

1 source
02

Active Exploitation Forces Advisory Revision

2026-10-26 – 2026-10-26

Public release of exploit code accelerated attacks, forcing the agency to broaden its warning to cover an extra software flaw. JPCERT/CC had monitored public forums after its October 22 patch instructions as functional exploit scripts spread across online security circles. The agency updated its alert on October 26 after tracking live attacks against exposed PHP servers, adding CVE-2026-115560 to its docket and telling delayed defenders to audit system logs for signs of compromise.

1 source

Where things stand

The updated alert confirms that public exploit blueprints are now actively running against internet-facing servers. Defense teams must look backward through server traffic records rather than simply applying patches, checking whether newer exploit variants slipped past initial server workarounds.

Sources