Serious PHP flaw found; patch issued as Japanese firms and agencies pause services
In short
The IPA, a body under Japan's Ministry of Economy, Trade and Industry, said on 21 October that serious vulnerabilities had been found in the programming language PHP, which is reported to run about 70% of the world's websites. The PHP development team published a fix around 23:00 Japan time, and Japanese banks, a ministry and retailers suspended some services for checks.
Read the full story 2 min read
The IPA, which is overseen by the Ministry of Economy, Trade and Industry, announced on 21 October that serious vulnerabilities had been found in PHP, a programming language used on web pages. It asked companies and others to respond quickly using the fix. Sankei reported that the operating body of PHP said it would distribute a fix at 23:00 Japan time on the 21st, and Yomiuri said the development team published it at about that time. ITmedia said the patch was published on the website late on 21 October. [ 2 , 3 , 4 , 5 , 6 ]
According to Jiji Press, the development team said there were two vulnerabilities, both related to how the program uses memory. If exploited, an attacker could run arbitrary programs remotely and take over a site. Both Jiji and Yomiuri said the flaws were rated "critical", the highest level on an international severity scale. Jiji added that a security team owned by Google, which helped find the flaws, called it one of the most serious vulnerabilities in the history of software. Sankei, however, reported that the operator had not published details. [ 2 , 5 , 7 ]
PHP is used on about 70% of the world's websites, according to W3Techs, a European web technology survey service cited by Yomiuri. Yahoo! News Japan cited a European research body's figure of 69.3%. Jiji said PHP is offered as open source and underlies the software of Wikipedia and the site-building tool WordPress. Sankei described it as a leading example of server-side scripting that is also used in applications managing server databases. [ 2 , 4 , 5 , 7 ]
The National Cybersecurity Office posted on X calling for a prompt response using the fix, and warned that without proper action sites could be compromised. Yahoo! News Japan quoted a developer's comment on the web that updating is the only safe option. Prime Minister Sanae Takaichi posted on X that if a response is difficult, temporarily suspending a website is considered an effective option for reducing risk. [ 3 , 4 , 5 ]
Organisations in Japan suspended some services. Yomiuri reported that the Ministry of Finance temporarily suspended part of its website content and services for emergency checks and patching, Mizuho Bank suspended its online store-visit reservation service, and Rakuten Group carried out emergency maintenance on some pages of Rakuten Ichiba. Sankei reported that online shop service BASE carried out emergency maintenance as a precaution and that the Tokyo University of Foreign Studies said it would inspect its web servers. Nishi-Nippon Shimbun said banks and others suspended some services because of the risk of cyberattack. [ 2 , 3 , 5 ]
Why it matters
Japanese outlets report that PHP is used on about 70% of websites worldwide, and that ministries, local governments and companies were rushing to respond. The IPA and the National Cybersecurity Office urged prompt patching, and the prime minister said suspending a site is one option if patching is hard.
Key facts
- The IPA, which is overseen by the Ministry of Economy, Trade and Industry, announced on 21 October that serious vulnerabilities had been found in PHP and asked companies to apply the fix quickly. [ 3 , 4 ]
- The PHP development team published a fix at about 23:00 Japan time on 21 October. [ 2 , 5 , 6 ]
- PHP is reported to be used on about 70% of the world's websites; Yahoo! News Japan cited a European research body's figure of 69.3%. [ 1 , 2 , 4 , 5 , 7 ]
- The development team reported two vulnerabilities, both related to how the program uses memory, rated "critical", the highest level on an international severity scale. [ 5 , 7 ]
- Prime Minister Sanae Takaichi posted on X that temporarily suspending a website is one effective way to reduce risk if a response is difficult. [ 3 , 4 , 5 ]
- The Ministry of Finance, Mizuho Bank, Rakuten Ichiba, BASE and some other banks suspended some content or services for checks or maintenance. [ 2 , 3 , 5 ]
Confirmed by several sources
- The IPA announced on 21 October that serious vulnerabilities had been found in PHP and urged companies to respond promptly. [ 2 , 3 , 4 ]
- A fix for PHP was published late on 21 October, Japan time. [ 2 , 3 , 4 , 5 , 6 , 7 ]
- PHP is used on about 70% of the world's websites, according to the figures cited. [ 1 , 2 , 4 , 5 , 7 ]
- Takaichi posted on X that temporarily suspending a website is an effective option if a response is difficult. [ 3 , 4 , 5 ]
- The National Cybersecurity Office posted on X urging a prompt response using the fix. [ 3 , 5 ]
- Banks and other organisations suspended some services in Japan. [ 2 , 3 , 5 ]
Still unclear
- What the flaws are in detail. Sankei said the operator had not published details, while Jiji and Yomiuri gave details from the development team's information (two memory-related flaws, rated critical).
- When the vulnerabilities were first announced. Yahoo! News Japan said the developers announced two serious vulnerabilities by early on the 21st Japan time, while other outlets describe the fix being published at about 23:00 that day.
- Whether any attack has actually occurred. The documents describe a risk of cyberattack and sites being taken over, but none reports a confirmed attack.
What local media are saying
Timeline, local time
- Sankei reports that the PHP operator announced it would distribute a fix at 23:00 Japan time. [ 2 ]
- Nishi-Nippon Shimbun reports the IPA announcement and that banks had suspended some services. [ 3 ]
- The PHP development team publishes the fix, at about this time. [ 2 , 5 ]
- Yomiuri reports that the Ministry of Finance, Mizuho Bank and Rakuten had suspended some content or services. [ 5 ]
- ITmedia reports that the patch had been published late on 21 October. [ 6 ]
- Jiji Press reports that the development team had released a corrected version. [ 7 ]