TOKYO - A critical security flaw discovered in PHP, a programming language used by an estimated 70% of the world's web systems, has triggered widespread disruptions across Japan since October 21, forcing banks, restaurant chains, government agencies and other businesses to suspend online services as a precaution against potential cyberattacks.
The vulnerability, announced on October 21, has raised concerns that attackers could exploit weaknesses in websites and potentially take control of affected systems. Although the organization responsible for PHP released a security patch at 11 p.m. that day, companies and government agencies have temporarily disabled services while implementing protective measures.
The disruption has affected several major restaurant operators. Zensho Holdings, which operates the Sukiya beef bowl chain and Hama Sushi conveyor-belt sushi restaurants, suspended reservation applications, while Curry House CoCo Ichibanya halted online and app-based reservation orders.
Financial institutions have also been affected, with numerous regional banks and major securities companies suspending portions of their online services. Mizuho Bank and Resona Bank have since resumed their branch appointment booking systems, although other institutions have continued taking precautions.
The Japan Meteorological Agency announced that it was conducting emergency maintenance as part of its cybersecurity measures. Some online content, including weather data and volcanic observation records, remained unavailable at 3 p.m. on October 22.
The impact has extended to transportation and manufacturing. Odakyu Electric Railway, a major private railway operator, and food manufacturer Meiji were among the companies whose websites became temporarily inaccessible.
Prime Minister Sanae Takaichi's office also temporarily blocked access to its website after the vulnerability was disclosed. Speaking to reporters at around 10:30 a.m. on October 22, Takaichi asked whether their companies' websites were functioning properly before explaining that her own office had taken its site offline.
The website was restored by 4 p.m. the same day.
Takaichi later commented on X that the incident had reinforced her belief that temporarily shutting down a website could be an important security measure, depending on the circumstances.
Chief Cabinet Secretary Kihara urged organizations operating websites that use PHP to apply the security patch promptly. He said the government would continue issuing necessary warnings and taking appropriate action to address the vulnerability.
Authorities said no damage directly related to the security flaw had been reported so far, although cybersecurity specialists warned that the discovery could lead to actual attacks if vulnerable systems remained unprotected.
PHP plays a central role in the operation of websites around the world. Originally derived from the name "Personal Home Page Tools," the programming language is widely used to process information behind the scenes when people interact with websites.
For example, when a customer places an order through an online shopping site, PHP can handle the processing required to complete the purchase and display an order confirmation. Its function is comparable to that of a store employee receiving and processing an order, rather than simply displaying information to the customer.
Takashi Yonai, chief technology officer at cybersecurity company GMO Flatt Security, said some estimates suggest that PHP is used in the background of approximately 70% of web systems worldwide.
That extensive use helps explain why a vulnerability in the programming language has caused such widespread concern across industries.
Even organizations that do not directly operate PHP-based systems may be affected because external contractors and service providers could be using the language in applications developed for their clients.
Takayuki Sugiura, representative director of the Japan Hackers Association, warned that PHP may be operating in systems without the knowledge of the organizations relying on them.
He said even highly experienced technology professionals may have difficulty determining whether a particular company or service uses PHP, especially when systems are managed by outside providers.
The complexity of modern web infrastructure has consequently made it difficult for businesses to assess their exposure quickly, contributing to the large number of precautionary service suspensions.
The disruption has also reached services that are not directly associated with financial transactions or major commercial operations. A website providing free illustrations, for example, experienced partial service interruptions, demonstrating how the vulnerability can affect everyday online activities.
The PHP development organization released a corrective update late on October 21 to address the weakness. Cybersecurity specialists have emphasized that applying the patch is essential to preventing attackers from exploiting affected systems.
However, installing and verifying the update may require website operators to interrupt their services temporarily. Many of the shutdowns reported in Japan were preventive measures rather than responses to confirmed cyberattacks.
For individual internet users, the immediate security implications are different from those facing businesses and website administrators.
Because the vulnerability affects the systems operating websites, ordinary smartphone and computer users generally do not need to install a special PHP update on their personal devices.
The more immediate concern is that criminals could exploit public anxiety surrounding the security warning to distribute fraudulent messages.
Cybersecurity specialists have advised consumers to be cautious of suspicious emails or messages claiming that urgent security updates are necessary. Such messages may contain malicious links designed to steal personal information or install harmful software.
Users should avoid clicking unfamiliar links or following unsolicited instructions to update their devices in response to the PHP warning.
The incident highlights the dependence of online services on widely used software components that often remain invisible to consumers and even to some of the companies using them.
While the prompt release of a security patch has provided website operators with a means of addressing the flaw, experts warn that further incidents could occur if organizations fail to implement the update before attackers attempt to exploit the vulnerability.
Source: TBS
