Manga platforms enter emergency maintenance after critical PHP flaws
Magazine Pocket, K MANGA and other manga services are patching after critical PHP flaws were disclosed, but the notices do not confirm breaches.
Several major manga-reading and digital publishing services entered emergency maintenance on 21 October after PHP developers disclosed two critical vulnerabilities affecting web-facing installations. The flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 under CVSS 4.0 and can allow unauthenticated remote code execution on vulnerable servers. PHP published security releases for versions 8.5, 8.4, 8.3 and 8.2, while warning operators that updating is the complete fix. 1
The timing has been particularly disruptive for Japanese manga services. Kodansha's Magazine Pocket said its app and website were entering emergency maintenance from 10:30 p.m. JST, directly citing an urgent PHP security update. K MANGA, also operated by Kodansha, announced a critical security update at the same time and warned that new chapter releases could be delayed while the work continued into 22 October. 2
Shueisha's MANGA Plus also entered maintenance from 9 p.m. JST on 21 October, although its public notice did not name PHP as the cause. Niconico Manga suspended its services until 10 a.m. JST on 22 October, saying a serious vulnerability had been found in software it uses. BOOK☆WALKER likewise reported emergency maintenance after finding a serious software vulnerability and said it had not been directly attacked. 2
That distinction matters. The maintenance announcements show that publishers are responding to a serious security risk, but they do not establish that these services were breached. Japan's Information-technology Promotion Agency said it had not independently confirmed attacks exploiting the vulnerabilities at the time of its warning, and described its notice as precautionary. 3
The immediate effect for readers is uncertainty around scheduled chapters. Magazine Pocket and K MANGA both warned that releases could be delayed, but neither service had tied a specific chapter to the outage. The Fragrant Flower Blooms with Dignity, for example, had upcoming listings around the same period, yet the maintenance notices did not confirm that any particular chapter was cancelled or postponed. Readers should wait for each platform's own restoration notice rather than treating the service interruption as proof of a lost release.
The broader lesson is less dramatic but more useful: a maintenance screen can be evidence of responsible patching, not evidence of an attack. PHP users running affected versions should update promptly, while manga readers should expect staggered restorations as each platform completes its checks.
Our opinion
This is the right kind of disruption to endure. Losing access to a chapter for a few hours is frustrating, but it is a better outcome than platforms rushing back online before confirming that a remote-code-execution flaw is closed. The services also deserve credit for separating what they know from what they do not: emergency maintenance is confirmed, while a breach is not.
The weak point is communication. Vague notices leave readers guessing whether a chapter is delayed, whether accounts are safe and when service will return. A short follow-up explaining which services are restored, whether scheduled releases moved and whether users need to take any action would turn a worrying outage into a manageable one.