Following the discovery of a critical security vulnerability in the PHP programming language, banks and telecommunications companies in Japan have temporarily suspended some internet services. These measures aim to prevent potential attacks and implement security updates. Japanese Prime Minister Sanae Takaiichi also temporarily closed her website, while the government urged rapid security updates for major infrastructure operators.
According to the Nihon Keizai Shimbun (Nikkei) on October 22, Mitsubishi UFJ Bank announced it would temporarily suspend some internet services due to system checks. This includes the opening of investment trust accounts, applications for the tax-exempt small investment system (NISA), and pre-approval for housing loans. Nikkei reported that these actions were in response to the PHP vulnerability. Daiwa Securities also halted online account openings and address changes through its website.
Kyodo News reported that Shizuoka Bank announced a temporary suspension of internet banking on October 21. However, the Japanese Bankers Association confirmed that there were no disruptions in interbank payments.
The situation has also affected the telecommunications, retail, and railway sectors. According to Nikkei, SoftBank suspended operations for its low-cost communication brand, Y!mobile. Asahi Shimbun reported that Daimaru Matsuzakaya department store ceased operations of its website and app from the night of October 21, rendering app payments and coupons unusable. JR East also closed some sites, including its online shopping mall, JRE Mall.
Government offices experienced disruptions as well. Yomiuri Shimbun reported that the Japan Meteorological Agency closed parts of its website from 3:30 a.m. on October 22, making it impossible to access the latest temperature, precipitation, and volcanic activity data. The agency stated that this was a preventive measure against potential attacks, assuring that disaster information such as weather and tsunami alerts remained unaffected.
PHP is a programming language used to process user information and product orders on websites. According to Asahi, two vulnerabilities announced by the PHP security team received a severity score of 9.2 on the international CVSS scale, indicating an 'urgent' level of severity. A patch was released around 11 p.m. on October 21.
Prime Minister Takaiichi stated on X on the night of October 21 that temporarily halting website operations was an effective way to reduce risks. She closed her own website that same night, which was accessible again around noon on October 22.
Chief Cabinet Secretary Minoru Kiuchi confirmed at a press conference on October 22 that the government had requested security updates from relevant agencies and major infrastructure operators, noting that no damage had been reported. However, the Ministry of Health, Labour and Welfare, and the Ministry of Finance indicated that some of their operated sites were closed.
Meanwhile, Yomiuri Shimbun reported that security firm Trend Micro detected exploit attempts targeting several servers in Japan due to the PHP vulnerability as of the morning of October 22. However, they could not confirm any damage.
Security firm GMO Flat Security explained to Nikkei that exploiting the vulnerability could allow attackers to take control of sites, halt operations, or extract information. Information about exploitation methods has already begun circulating on social media. They warned that using artificial intelligence could enable simultaneous attacks on multiple sites, and with the release of the patch, details about the vulnerability could become more widely known, increasing the risk of exploitation. They urged site operators to expedite security updates.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.