Magazine Pocket, K MANGA, MANGA Plus and More Enter Emergency Maintenance Due to Critical PHP Security Flaws

Several major manga and digital publishing platforms entered emergency maintenance on October 21 as companies moved to secure their services following the disclosure of two critical vulnerabilities in PHP, a programming language widely used across the web.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution on affected servers. The PHP development team rates both at 9.2 under CVSS 4.0 and has urged users to update immediately. Security releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were published on October 21. According to PHP, all installations serving web requests are potentially at risk, with Apache mod_php deployments considered particularly exposed.

The issue has resulted in precautionary maintenance on platforms worldwide, including several Japanese services used by manga readers.

Kodansha’s Magazine Pocket directly cited an urgent PHP security update when announcing the emergency maintenance. Both its app and web services became unavailable from 10:30 p.m. JST on October 21, with no reopening time initially given. The platform later acknowledged readers waiting for new chapters and said work was underway to restore access while maintaining system security.

K MANGA entered emergency maintenance at the same time, citing a “critical security update.” The service warned that new chapter releases could be delayed while the maintenance continues into October 22.

Shueisha’s MANGA Plus also entered maintenance from 9:00 p.m. JST on October 21. Its announcement did not publicly identify the reason.

Niconico Manga suspended all services from 7:00 p.m. JST on October 21, with maintenance scheduled to continue until 10:00 a.m. on October 22. The company said a serious vulnerability had been discovered in software it uses, but did not identify PHP by name.

BOOK☆WALKER similarly began emergency maintenance after identifying a serious vulnerability in software used by the service. The company specifically stated that it had not been directly attacked and expected services to return by early October 22.

One manga potentially affected by the timing is Saka Mikami’s The Fragrant Flower Blooms with Dignity. Magazine Pocket lists its next Japanese update for October 22, following Chapter 204 on October 8. K MANGA also has a listing for Chapter 205, titled “Saku’s Answer,” dated October 21, while the service separately warned that new chapter releases could be delayed during maintenance. Neither Magazine Pocket nor K MANGA specifically named Chapter 205 in its maintenance notice.

The emergency response follows advance warnings from the PHP security team and CERT-EU. CERT-EU advised organizations to prepare to patch immediately, while PHP has since said that updating is the only complete solution to the vulnerabilities.

Importantly, the maintenance notices do not by themselves indicate that the affected manga platforms were breached. Japan’s Information-technology Promotion Agency said that, at the time of its warning, it had not independently confirmed attacks exploiting the two PHP vulnerabilities and was issuing its notice as a precaution.

Service restoration times remain dependent on each platform’s security work, with additional updates expected from their official channels.

Source: PHP, IPA, Magazine Pocket, K MANGA, MANGA Plus, Niconico Manga, BOOK☆WALKER