Serious PHP flaw forces Japanese airport, bank, school and rail websites offline
In short
After a serious flaw was found in the PHP programming language, organisations in the Kansai region and Miyagi Prefecture suspended websites or services on 21 October while applying a fix. The PHP developers released a patch late that night, Japan time, and affected organisations are expected to restore services once it is applied.
Read the full story 2 min read
A serious flaw found in the PHP programming language led organisations in the Kansai region and Miyagi Prefecture to suspend websites or services. Sankei Shimbun reported that, after the problem was found, the PHP developers released a patch late on 21 October, Japan time, and that affected companies expected to restore services once they had applied it. [ 1 , 2 , 3 ]
Osaka Prefecture suspended search functions for press releases and statistical materials from about 23:40 on 21 October to apply the patch. It said it would resume service as soon as safety could be confirmed. Osaka Metro and Hanshin Electric Railway also temporarily suspended website services on the same day, saying they needed to respond to a vulnerability. Ryukoku University, which has campuses in Kyoto and Shiga prefectures, announced system maintenance and blocked off-campus access to its official site. Osaka Prefecture Citizens' Mutual Aid and the Hanshin Tigers baseball club also suspended services, including the Tigers' official fan club and online shop. [ 1 ]
In Miyagi Prefecture, Nippon TV and TBS reported that Sendai Airport's website was taken offline for emergency maintenance. TBS said access stopped from about 22:00 on 21 October, so flight information could not be checked. The airport's operator asked passengers to check airline websites for ticket reservations, and Nippon TV said it asked them to check with airlines on operating status. [ 2 , 3 ]
According to the Miyagi Prefectural Board of Education, the websites of 91 prefectural schools were suspended for emergency maintenance, and TBS said they had been unavailable since the night of 21 October. Nippon TV reported that Seventy-Seven Bank announced on the night of 21 October that it was suspending some services, including those of group companies. The bank described this as a precautionary measure to ensure safety and said no information leak had been confirmed so far. TBS said Seventy-Seven Bank and Sendai Bank both warned that some services might be unavailable during emergency maintenance. [ 2 , 3 ]
Nippon TV reported that the flaws, two in number, could allow outside parties to manipulate systems without authorisation, and that PHP is used by about 70 percent of the world's websites. It said the developers urged quick updates. TBS said the risk of cyberattacks exploiting the vulnerability had risen and that PHP strongly recommended updating immediately. [ 2 , 3 ]
Why it matters
The outages show how far one flaw in a widely used web language reached across public bodies, transport operators, a bank, a university and a sports club. TBS reported a heightened risk of cyberattacks exploiting the vulnerability, and PHP strongly recommends updating immediately.
Key facts
- A serious flaw was found in the PHP programming language, and the PHP developers released a patch late on 21 October, Japan time. [ 1 , 2 , 3 ]
- Osaka Prefecture suspended search functions for press releases and statistical materials from about 23:40 on 21 October to apply the patch. [ 1 ]
- Osaka Metro, Hanshin Electric Railway, Ryukoku University, Osaka Prefecture Citizens' Mutual Aid and the Hanshin Tigers suspended websites or services. [ 1 ]
- In Miyagi Prefecture, Sendai Airport's website went offline for emergency maintenance, and the websites of 91 prefectural schools were also suspended. [ 2 , 3 ]
- Seventy-Seven Bank suspended some services, including those of group companies, as what it called a precautionary measure; it said no information leak had been confirmed so far. [ 2 ]
Confirmed by several sources
- A serious flaw in PHP led to emergency maintenance and website suspensions in Miyagi Prefecture. [ 2 , 3 ]
- PHP developers released a fix on 21 October, Japan time. [ 1 , 2 , 3 ]
- Sendai Airport's website was taken offline for emergency maintenance, and passengers were told to check with airlines for flight and ticket information. [ 2 , 3 ]
- Miyagi Prefecture's prefectural school websites were suspended from the night of 21 October, according to the prefectural board of education. [ 2 , 3 ]
- Seventy-Seven Bank said some services could be unavailable during emergency maintenance. [ 2 , 3 ]
Still unclear
- How many websites worldwide use PHP, and how many flaws were found. Only Nippon TV says PHP is used by about 70% of the world's websites and that two flaws were found; the other documents do not give figures.
- Whether any attack exploiting the flaw has occurred. Seventy-Seven Bank said no information leak had been confirmed so far; TBS only said the risk of attack had risen. The other documents do not address this.
- When suspended services will resume. Sankei said companies are expected to resume after applying the patch; Osaka Prefecture said it would resume once safety is confirmed. No resumption times are given.
What local media are saying
Timeline, local time
- Sendai Airport's website becomes inaccessible for emergency maintenance, around this time on 21 October. [ 3 ]
- Osaka Prefecture begins suspending search functions on its site to apply the patch, around this time on 21 October. [ 1 ]
- Sankei Shimbun publishes its report on 22 October. [ 1 ]
- Nippon TV News publishes its report on 22 October. [ 2 ]
- TBS NEWS DIG publishes its report on 22 October. [ 3 ]