Japan to simulate cyberattacks as PHP flaws roil global internet (updated)

Asahi group

23/10/2026 10:13

    * SoftBank suspends mobile emergency alerts during
maintenance to address PHP vulnerability
    * JR East restores some services while others remain offline
pending safety checks
    * PHP developers released fixes on Wednesday and urged users
to update immediately

    (Updates details in paragraph 18)
       TOKYO, Oct 23 (Reuters) - Japan said on Friday it will
set up a team to simulate cyberattacks using AI to identify
weaknesses in technology systems as organisations scramble to
curtail risks from flaws in the PHP programming language that
underpins much of the internet.
    Government and company websites across the world went
offline this week after the disclosure of critical
vulnerabilities in the widely used programming language prompted
millions of hacking attempts, forcing website operators to rush
to protect or temporarily shut down their systems.
    Highlighting the extent of the disruption, Japan's
third-largest mobile carrier, SoftBank  9434.T , said on Friday
it was suspending its emergency alert system for mobile users. 
    That means customers will not receive early warnings for
earthquakes, tsunami alerts or disaster and evacuation
information as the system undergoes maintenance to address a PHP
vulnerability, SoftBank said.
    Japan ​is regularly affected by natural disasters and is one
⁠of the world's most earthquake-prone countries, with typhoon
Champi currently approaching the southernmost prefecture of
Okinawa. 
    SoftBank, which has more than 30 million smartphone
customers, said users can still receive earthquake warnings
through services such as an app from its Yahoo business. 
    "An attack can succeed by getting through just one hole ...
for that reason it's important we shift our mindset and think
from the perspective of the attacker," Japanese industry
minister Ryosei Akazawa said on Friday. 
    "Defenders also need to make use of AI and respond
proactively, staying one step ahead."
    Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J
Corp, said the government response was too slow. 
    "This is like trying to take on a bomber with a bamboo
spear," he said. 
    Emergency shutdowns this week from Tokyo to Helsinki of
banking, airline, rail, tax and government services marked one
of the most dramatic tests of the decades-old programming tools
that keep the web running.
    Companies including brokerage Nomura  8604.T , lender
Mitsubishi UFJ Financial Group  8306.T , airline ANA  9202.T 
and East Japan Railway (JR East)  9020.T  temporarily suspended
some internet services as part of emergency measures.
    Japan's Ministry of Finance, National Tax Agency and
Meteorological Agency also suspended some online services.
    On Friday, JR East said some group services had resumed
while others would be restored once confirmed safe. Nippon Paint
 4612.T  said it had applied a security patch as a precaution
and its website is back online.
    Attackers are likely targeting Japanese businesses for their
thorough records, which are no longer protected by a language
barrier because of AI, said Eva Chen, CEO of Trend Micro
 4704.T .      
    Japan has been too comfortable with its existing
infrastructure, which it felt was safe enough, she said.
    Cybersecurity experts have said AI is helping attackers
automate tasks ​from scanning for software vulnerabilities to
crafting phishing campaigns, making cybercrime faster, cheaper
and harder to detect.
    The developers of PHP released fixes on Wednesday for
vulnerabilities that had lurked in the software for years until
they were uncovered using AI. They urged users to "update
immediately".

    <^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    Governments, companies take websites offline over PHP flaws 
   ID:nL6N46813V 
    Websites taken offline over PHP risks     ID:nL6N467188 
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^>
    (Reporting by Kentaro Okasaka, Anton Bridge, Sam Nussey,
Satoshi Sugiyama, Daniel Leussink. Editing by Anne Marie
Roantree, Lincoln Feast and Mark Potter)
 ((mailto:annemarie.roantree@thomsonreuters.com; +852 97387151;
Reuters Messaging:
rm://annemarie.roantree.thomsonreuters.com@reuters.net/))