PHP flaw leads Kansai railways, university, banks and hosts to suspend web services
In short
After a serious vulnerability was found in the PHP programming language, companies and organisations in Kansai, Kyoto and Shiga began suspending websites and online services from the 21st. Keihan, Hanshin, Osaka Metro, Ryukoku University and Kyoto Bank are among those affected, and the firms say the stops are precautionary.
Read the full story 2 min read
Companies and organisations in Kansai and nearby areas have suspended websites and online services since the 21st after a serious vulnerability was found in PHP, a programming language widely used for websites and online services, Nippon TV News and TBS NEWS DIG reported. Nikkei reported that suspensions in Kyoto and Shiga began from the night of the 21st. [ 1 , 2 , 3 ]
Among railways, Keihan Electric Railway said on the 21st that it needed to deal with the vulnerability and was suspending its website, so train operation information could not be checked there. Hanshin Electric Railway also announced on the 21st that it would suspend its website, saying details of the security problem and a fixed version were expected to be published. Neither gave a restart date. Osaka Metro suspended member-site login, new registration and some forms, citing system maintenance. TBS NEWS DIG reported that the sites of Keihan, Hankyu, Hanshin and Nankai were all suspended or showed maintenance screens, leaving users unable to check delays, detours or timetables in a browser. It also reported that JR West group sites, including those for the Twilight Express Mizukaze and the Kyoto Railway Museum, were inaccessible. [ 1 , 3 , 4 , 5 ]
Other sectors were also hit. Ryukoku University began emergency system maintenance on the 21st and blocked off-campus connections to its official site. Osaka Fumin Kyosai (大阪府民共済) suspended nine services, including its My Page. Nippon TV said Daimaru Matsuzakaya's homepage, app payments and coupons were affected, and that the Hanshin Tigers fan club and official online shop were stopped. Kyoto Bank stopped updating its homepage from the morning of the 22nd and halted some web services from around 20:00 on the 21st, which it called a precautionary measure for safety, Nikkei reported. [ 1 , 2 ]
TBS NEWS DIG reported that the Osaka prefectural government stopped several database-linked search windows for residents from late on the 21st, and that Moriguchi city and Seika town suspended some online resident services. It said access to Osaka Gas's member site was restricted. It also said Sakura Internet stopped providing its cloud database management screen, Xserver temporarily blocked access to account management screens to apply a fixed version, and Zenlogic carried out emergency maintenance. [ 3 ]
TBS NEWS DIG described the flaw as one that lets a server's programs be run remotely without authentication, with a severity score of 9.2 out of 10. It reported that the developers had planned to release a fix on the evening of the 22nd, but technical information leaked online, so the fix was released earlier, late on the 21st Japan time. Because temporary configuration changes cannot fully block attacks, it said, companies chose to disconnect servers from the public network. [ 3 ]
Nippon TV said the suspensions do not mean that unauthorized access or a leak of personal information has occurred. TBS NEWS DIG said the companies involved described the maintenance as a precautionary measure rather than a response to cyberattack damage. Nippon TV said how long the effects on users will last is being watched. [ 1 , 3 ]
Why it matters
The suspensions have left some users unable to check train operation information online and have cut access to member, payment and resident services. Nippon TV said how long the effects on users will last is being watched.
Key facts
- A serious vulnerability in the programming language PHP has led companies in Kansai, Kyoto and Shiga to suspend websites and online services since the 21st. [ 1 , 2 , 3 ]
- Keihan Electric Railway and Hanshin Electric Railway announced on the 21st that they were suspending their websites; no restart date has been set. [ 1 , 3 ]
- TBS NEWS DIG reported that the websites of Keihan, Hankyu, Hanshin and Nankai were all suspended or showed maintenance screens. [ 3 ]
- Ryukoku University blocked off-campus access to its official site and other services for emergency maintenance. [ 1 , 3 ]
- Kyoto Bank stopped updating its homepage from the morning of the 22nd and stopped some web services from around 20:00 on the 21st, calling it a precautionary measure. [ 2 ]
- Hosting providers Sakura Internet, Xserver and Zenlogic also carried out emergency measures, TBS NEWS DIG reported. [ 3 ]
- JR West group sites, including those for the Twilight Express Mizukaze and the Kyoto Railway Museum, were also inaccessible. [ 5 ]
Confirmed by several sources
- Keihan Electric Railway suspended its website, and train operation information could not be viewed there. [ 1 , 3 , 4 ]
- Hanshin Electric Railway suspended its website services. [ 1 , 3 ]
- Ryukoku University stopped off-campus access to its official site for emergency maintenance. [ 1 , 3 ]
- The suspensions were described as precautionary rather than a response to damage: Nippon TV said they do not mean unauthorized access or a leak of personal information occurred, and TBS NEWS DIG said the companies cited precautionary measures, not cyberattack damage. [ 1 , 3 ]
Still unclear
- When the suspended services will resume. Nippon TV said Keihan and Hanshin have not set restart dates, and Osaka Metro said it will announce the end of maintenance later.
- Whether the PHP technical information leaked online before the fix was released. Only TBS NEWS DIG reports that the information leaked and that the fix was released early; the other documents do not mention it.
- The severity score of 9.2 out of 10 and the remote-execution description of the flaw. These come from TBS NEWS DIG alone.
What local media are saying
Timeline, local time
- On the 21st, Kyoto Bank begins stopping some web services. [ 2 ]
- Nippon TV News reports that Kansai railways, a university and department stores are suspending web services. [ 1 ]
- Nikkei reports suspensions at companies in Kyoto and Shiga, including Kyoto Bank. [ 2 ]
- TBS NEWS DIG reports that Sakura Internet, four Kansai private railways and local governments have suspended services. [ 3 ]
- Nippon TV News reports that Keihan and Osaka Metro sites are down and train operation status cannot be checked. [ 4 ]
- TBS NEWS DIG reports that some JR West group web pages are also inaccessible. [ 5 ]