Takaichi urges Japanese firms to patch PHP flaws, suspend websites if needed
In short
Prime Minister Sanae Takaichi said on X on 21 October that companies should prepare to apply the fix for two serious vulnerabilities in the PHP programming language as soon as possible. She said temporarily suspending websites is one effective way to reduce risk if patching is difficult. PHP released the fix at about 23:00 Japanese time, and many Japanese services went into emergency maintenance.
Read the full story 2 min read
Prime Minister Sanae Takaichi on 21 October asked companies to prepare to apply the fix for serious vulnerabilities found in the PHP programming language. In a post on X, she asked for preparation so the fix could be applied as quickly as possible once released, according to Nikkei, Mainichi and TBS. [ 2 , 3 , 4 ]
Takaichi also said that if prompt application of the fix is difficult, temporarily suspending websites is one effective way to reduce risk. TBS quoted her as asking people to respond that night. Nippon TV and ITmedia put the post at around 22:00. [ 3 , 4 , 6 , 8 ]
TBS reported that the PHP security team had issued an alert about two serious vulnerabilities and planned to release a fix at 23:00 Japanese time. Nikkei said the National Cyber Office also warned companies and other users. ITmedia said the office had called for the same measures on X. Nikkei said PHP is said to be used by about 70 percent of websites worldwide. [ 2 , 4 , 8 ]
ITmedia reported that both flaws could allow arbitrary code to be run remotely without authentication. It said information about them leaked online before the fix was released, proof-of-concept code circulated and attack attempts were observed. PHP began releasing the fixed version from about 23:00 Japanese time on 21 October, as planned. [ 8 ]
Nippon TV reported that company and municipal websites in Japan were going into emergency maintenance that night. ITmedia named the online shop service BASE, Cygames games including Uma Musume Pretty Derby and Shadowverse: Worlds Beyond, and the childcare service Kodomon among those that did so. [ 6 , 8 ]
ITmedia described it as unusual for a prime minister to call for action on a specific software vulnerability on X. It said engineers gave the move some praise, one saying the prime minister's message makes executives aware of the risk. It added that system downtime concerns sometimes lead to patching being postponed, and that her suspension advice could help executives decide to halt systems. [ 8 ]
Why it matters
ITmedia described it as unusual for a prime minister to call for action on a specific software vulnerability on X. The outlet said the suspension advice could help business executives decide to halt systems, which can otherwise delay patching over concern about the effect on operations.
Key facts
- Takaichi posted on X on 21 October asking for preparation to apply the PHP fix as quickly as possible once it was released. [ 2 , 3 , 4 , 5 , 8 ]
- She said that if prompt patching is difficult, temporarily suspending websites is one effective way to reduce risk. [ 2 , 3 , 4 , 5 , 8 ]
- The PHP security team issued an alert about two serious vulnerabilities. [ 4 , 6 , 8 ]
- PHP began releasing the fix at about 23:00 Japanese time on 21 October, as scheduled. [ 4 , 8 ]
- ITmedia said both flaws could allow arbitrary code to be run remotely without authentication. [ 8 ]
- Company and municipal websites, online shop service BASE, games by Cygames (サイゲームズ) and the childcare service Kodomon (コドモン) went into emergency maintenance. [ 6 , 8 ]
Confirmed by several sources
- Prime Minister Takaichi publicly asked companies on X to prepare to apply the PHP fix as soon as possible. [ 2 , 3 , 4 , 5 , 8 ]
- She said temporarily suspending websites is an effective risk-reducing measure if patching cannot be done quickly. [ 2 , 3 , 4 , 5 , 8 ]
- The alert concerns two serious PHP vulnerabilities. [ 4 , 6 , 8 ]
- PHP released the fix around 23:00 Japanese time on 21 October. [ 4 , 8 ]
- Japanese company and other websites went into emergency maintenance on the evening of 21 October. [ 6 , 8 ]
Still unclear
- Whether PHP is used by about 70 percent of websites worldwide. Only Nikkei gives this figure, and it says PHP is 'said to be' used by that share.
- How far the flaws were exploited before the fix. Only ITmedia reported that details leaked before release, that proof-of-concept code circulated and that attack attempts were observed.
- Exact timing of the fix release. TBS and ITmedia say about 23:00 Japanese time, while Jiji Press says late on 21 October.