PHP ships fixes for two leaked critical flaws ("php2shell", CVSS 9.2) at 14:00 UTC today. Affected versions are still unconfirmed by PHP.
Some Japanese services didn't wait: childcare app Codmon stopped everything, website builder Studio froze its editor, Sakura Internet paused some functions. Pausing before a patch is a security decision, not a failure.
https://japancyberwatch.com/articles/php2shell-critical-php-flaws-japan-services-pause-2026