High-severity PHP vulnerability php2shell affects travel and transportation websites

On October 28, 2026, the PHP programming language was disclosed to have a high-severity security vulnerability named php2shell, which allows attackers to take control of web servers without a password. Cybersecurity agencies required organizations to patch immediately, or shut down websites if they could not patch. The language supports about 70% of websites worldwide, including those of government agencies, travel brands and destination marketing organizations. As a result, ANA suspended some services on its website and app as a precaution, including Apple Wallet boarding passes; Japan Airlines took some web pages offline, and East Japan Railway also suspended some services. Currently, the companies have taken measures to suspend or take some online services offline, and no follow-up reports on vulnerability patching and recovery progress have been seen.