On the evening of October 21, several of the biggest manga platforms in the world went offline at roughly the same time. MANGA Plus, Kodansha's Magazine Pocket, K MANGA, Niconico Manga and BOOK☆WALKER all entered emergency maintenance within a few hours of each other.
The cause was not a hack. It was PHP.
What happened
Two vulnerabilities in PHP, the language running a huge share of the web, were disclosed as CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution, and the PHP development team rates each of them at 9.2 under CVSS 4.0. In plain terms: an attacker does not need a login, and getting in can mean running whatever code they like on the server.
PHP shipped fixes the same day. The patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the PHP project, any installation serving web requests is potentially exposed, with Apache mod_php setups considered the most dangerous configuration.
That last detail explains the panic. mod_php is everywhere. It is also the kind of thing that sits on a shared hosting box for years because nobody wants to be the person who migrates it.
How each platform responded
Magazine Pocket named the reason outright, telling users it was carrying out an urgent PHP security update. Both the app and the web service went down at 10:30 p.m. JST on October 21, with no reopening time given at first. The service later acknowledged readers waiting on new chapters and said it was working to restore access without weakening security.
K MANGA went down at the same moment, citing a critical security update, and warned that new chapter releases could slip while maintenance ran into October 22.
Shueisha's MANGA Plus started maintenance at 9:00 p.m. JST on October 21. Its notice did not state a reason.
Niconico Manga suspended everything from 7:00 p.m. JST, with maintenance scheduled through 10:00 a.m. on October 22. The company said a serious vulnerability had been found in software it uses, without naming PHP.
BOOK☆WALKER took the most careful line of the group. It said it had found a serious vulnerability in software it relies on, stated explicitly that it had not been attacked, and expected service back by early October 22.
The chapter that got caught in the middle
Saka Mikami's The Fragrant Flower Blooms with Dignity had a release lined up in exactly the wrong window. Magazine Pocket lists its next Japanese update for October 22, following chapter 204 on October 8. K MANGA separately lists chapter 205, titled "Saku's Answer," dated October 21.
Neither platform tied that chapter to its maintenance notice, and K MANGA's warning about delayed releases was general rather than specific. Readers waiting on that chapter should treat the date as unconfirmed until the service is back and the chapter is visible.
Why this is not the same as a breach
Japan's Information-technology Promotion Agency said that at the time of its warning it had not independently confirmed any attacks exploiting the two flaws, and that it issued the notice as a precaution. CERT-EU had also advised organizations to prepare to patch immediately.
So the honest reading is this: these platforms took themselves offline before anything happened, or before anything public happened. That is the right call, and it is also the boring answer nobody wants to hear when a chapter they were waiting for is missing.
The other point worth making is that patching is the only complete fix according to PHP. Blocking a path, adding a WAF rule, or turning off a module buys time. It does not close the hole.
The context nobody should skip
This lands a day after Comic CMOA confirmed unauthorized access to its servers and stayed offline, a mess that is still unresolved. Two unrelated security incidents hitting Japanese manga platforms in the same month is not a coincidence so much as a reminder of how much of this industry runs on the same small set of web stacks.
Every one of these services holds payment details, reading history and account credentials for millions of people. A remote code execution bug in the language underneath them is not an abstract IT problem. It is the difference between your library staying yours and not.
Source: Source: Anime Corner, citing PHP, IPA, Magazine Pocket, K MANGA, MANGA Plus, Niconico Manga and BOOK☆WALKER
Featured image: Illustration of K MANGA and MANGA Plus, via Anime Corner.
