On the evening of October 21, a wave of Japanese digital‑manga services temporarily shut down after the PHP development team warned of two critical vulnerabilities—CVE‑2026‑109618 and CVE‑2026‑109619. Both bugs allow unauthenticated remote code execution, earning a CVSS 4.0 score of 9.2. The PHP project responded by releasing immediate patches for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Because PHP powers a large share of web‑based applications, the security advisory triggered a global scramble. The PHP team urged every site handling web traffic to apply the updates without delay, noting that Apache’s mod_php configuration is especially vulnerable. Organizations such as CERT‑EU and Japan’s Information‑technology Promotion Agency (IPA) also issued pre‑emptive alerts, urging operators to patch as soon as possible.
In Japan, several high‑profile manga distribution platforms announced emergency maintenance, citing the need to integrate the PHP patches. The first to go offline was Kodansha’s Magazine Pocket. At 10:30 p.m. JST on October 21, both the mobile app and website stopped serving content. The publisher’s official X post explained that a “critical PHP security update” was the trigger and that service would resume once the fix was verified.
Magazine Pocket’s tweet can be viewed here. The platform’s notice also warned readers awaiting new chapters that release schedules might shift while engineers work on restoring access. One title potentially impacted is Saka Mikami’s The Fragrant Flower Blooms with Dignity, which had its next Japanese update slated for October 22.
K MANGA Joins the Shutdown
Kodansha’s K MANGA mirrored Magazine Pocket’s actions, entering emergency maintenance at the same time. The service’s X announcement referenced a “critical security update” without naming PHP directly. It further cautioned that the rollout of upcoming chapters could be delayed, with the maintenance window extending into October 22.
The tweet detailing K MANGA’s status is available here. Readers of ongoing series were advised to watch for further updates from the platform’s official channels.
Shueisha’s MANGA Plus Affected
Shueisha’s international service MANGA Plus also went into maintenance at 9:00 p.m. JST on October 21. Unlike the Kodansha services, the announcement did not explicitly reference the PHP issue, simply noting that the platform would be unavailable for an “emergency” fix.
The official notice can be read on Shueisha’s X account. No further details on the expected downtime were provided at the time of writing.
Niconico Manga and BOOK☆WALKER React
Niconico Manga suspended all operations at 7:00 p.m. JST, planning to resume service around 10:00 a.m. JST the following day. The company’s statement mentioned a “serious vulnerability” in its software stack but did not name PHP.
Similarly, BOOK☆WALKER entered emergency maintenance after discovering a serious software flaw. The retailer emphasized that it had not suffered a direct attack and expected to be back online by early October 22.
Both platforms posted updates on X: Niconico Manga’s notice is archived here, while BOOK☆WALKER’s announcement can be read here.
What the Vulnerabilities Mean for Readers
The PHP flaws themselves do not imply that any of the manga services were compromised. Japan’s IPA clarified that, as of the alert, it had not confirmed any attacks exploiting the vulnerabilities. The agency’s warning was precautionary, urging operators to patch before any malicious actors could take advantage of the bugs.
For users, the immediate impact is limited to temporary loss of access to new chapters and, in some cases, delayed release dates. The situation also underscores how deeply web‑based infrastructure is intertwined with the manga industry’s digital distribution model. Even a single programming language flaw can ripple across multiple platforms that host millions of readers daily.
Next Steps and Patching Guidance
PHP’s official archive lists the security releases at php.net. Site administrators are advised to upgrade to the newly released versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) and to verify that any custom modules—especially those using mod_php—are also patched.
The IPA’s pre‑alert, published here, provides additional technical details and recommended mitigation steps for Japanese organizations.
Each platform has pledged to keep readers informed via their official social‑media channels. As the maintenance windows progress, fans can expect further statements about restored functionality and any adjustments to upcoming chapter schedules.
Featured image: PHP, IPA, Magazine Pocket, K MANGA, MANGA Plus, Niconico Manga, BOOK☆WALKER
Source: Anime Corner