Japanese banks and government pause web services after serious flaw found in PHP
In short
Shizuoka Bank suspended its internet banking on 21 October after a flaw was found in the PHP programming language, saying no personal data had leaked. Yomiuri Shimbun reported that other major banks and Prime Minister Takaichi's website also paused services, and that the PHP development team released a fix late on 21 October.
Read the full story 2 min read
Shizuoka Bank, a unit of Shizuoka Financial Group, announced on its website on 21 October that it was temporarily suspending internet banking in response to the discovery of a flaw in the PHP programming language, Nikkei reported. The bank said no personal information had leaked and described the move as a precautionary measure intended to ensure safety. [ 1 , 2 ]
The services suspended from 21 October are the websites of the bank and its group companies and the smartphone app Shizugin. The bank said it will resume each service once necessary security measures and safety checks are complete, and gave no date. [ 2 ]
Yomiuri Shimbun reported that the PHP development team released a fix late on 21 October. According to information the team published at around 23:00, the vulnerability is rated 'critical', the highest level on an international scale, and an attacker could take over sites or servers, destroy internal systems or steal information. Yomiuri said sites and servers that are not fixed risk serious cyberattacks. It cited the European web technology research service W3Techs as saying PHP is used on 70% of the world's websites. [ 3 ]
Trend Micro, a Tokyo information security company, said that by the morning of 22 October it had detected attacks exploiting the flaw against several servers in Japan, and that it did not know whether any damage resulted. Chief Cabinet Secretary Kihara told a press conference on the morning of 22 October that the government had received no reports of related damage so far. [ 3 ]
Other institutions also acted. MUFG Bank said on 22 October that it had suspended internet services such as investment trust account opening, and Mizuho Bank and SBI Shinsei Bank stopped some web services from the night of 21 October. The National Cyber Directorate asked on X for the update to be applied as soon as possible and plans to check government websites. Prime Minister Takaichi said on X that if updating takes time, temporarily stopping a website is one effective way to reduce risk, and her own homepage was stopped for that reason, according to an office source. [ 3 ]
Yomiuri added that the White House said on 21 October, local time, that the US government is working with relevant bodies to speed up release of a fix. A US official told the paper that Washington received notice of the vulnerability on 16 October. Several European countries have also temporarily taken websites offline. [ 3 ]
Why it matters
Yomiuri reported that PHP is used on 70% of the world's websites, according to the research service W3Techs, and that government offices and companies in Japan are racing to respond. Unpatched sites and servers could face serious cyberattacks, the paper said, and Trend Micro has detected attacks on servers in Japan.
Key facts
- Shizuoka Bank, part of Shizuoka Financial Group, announced on its website on 21 October that it was temporarily suspending internet banking because of the PHP flaw. [ 1 , 2 ]
- The suspension covers the websites of the bank and its group companies and the Shizugin smartphone app. [ 2 ]
- The bank said there was no leak of personal information and called the suspension a precautionary measure to ensure safety. [ 2 ]
- The PHP development team published a fix late on 21 October; the vulnerability is rated at the highest severity level, 'critical', on an international scale. [ 3 ]
- MUFG Bank suspended internet services such as investment trust account opening, and Mizuho Bank and SBI Shinsei Bank also stopped some web services from the night of 21 October. [ 3 ]
- Trend Micro said it had detected attacks on several servers in Japan exploiting the flaw by the morning of 22 October, and does not know whether damage occurred. [ 3 ]
- Prime Minister Takaichi urged caution on X and said temporarily taking websites down can reduce risk; her own homepage was stopped as a precaution, an office source said. [ 3 ]
Confirmed by several sources
Still unclear
- Whether the attacks detected on servers in Japan caused any damage. Trend Micro told Yomiuri it has not determined whether there was damage; Chief Cabinet Secretary Kihara said no related damage had been reported to the government so far.
- When Shizuoka Bank will restore its internet banking. The bank said only that it will resume once necessary security measures and safety checks are complete.
What local media are saying
Timeline, local time
- Livedoor News publishes a report that Shizuoka Bank has suspended internet banking. [ 1 ]
- Nikkei reports Shizuoka Bank's announcement that it is suspending internet banking and the Shizugin app. [ 2 ]
- Around this time on 21 October, the PHP development team published information on the vulnerability; a fix was released late that night. [ 3 ]
- Yomiuri reports on 22 October that MUFG Bank, Mizuho Bank and others have paused services and that Prime Minister Takaichi's site is down. [ 3 ]