Sakura Internet disabled browser-based database management on its Database Appliance starting Oct. 21, cutting off one access route as it responded to PHP flaws that allow unauthenticated remote code execution.
The change affects phpMyAdmin, phpPgAdmin and pgAdmin. It does not cover Sakura’s separate Database Cluster. Sakura pointed affected customers to MariaDB- or PostgreSQL-compatible SQL clients as an alternative to browser access.
The PHP project said the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP installations handling web requests and could let attackers run code without logging in. Each received a 9.2 score under CVSS v4.0, a vulnerability severity rating system. The project identified PHP-FPM and Apache’s mod_php among the affected configurations and rated mod_php the highest risk.
Sakura said its broader emergency maintenance began before PHP published its security release on Oct. 21. EconoTimes previously outlined the PHP security update and affected configurations. The company has not announced when it will re-enable the browser interfaces.
