PHP programming language flaws prompt site shutdowns and warnings in Japan and Europe
In short
The developers of the programming language PHP said on 21 October that they had found two serious flaws and released a fix. Governments in Japan, the US, the UK, France, the Netherlands and Finland issued warnings, and some government and company websites were taken offline as a precaution.
Read the full story 2 min read
The development team of the programming language PHP said on 21 October that it had found two serious flaws that could lead to unauthorised external operation. It released a fix and asked users to update quickly. Nippon TV said the details of how the flaws arose and their cause had not been made clear. PHP is said to be used by about 70% of websites worldwide, and TBS reported that the flaws raised the risk of sites being taken over and information being stolen. [ 2 , 8 ]
Japan's National Cybersecurity Office urged organisations to prepare to apply the fix as soon as possible. TBS said the fix was due at 11pm Japan time on 21 October, and Asahi reported that it was distributed late that night. NHK reported that the Information-technology Promotion Agency also urged companies using PHP to respond quickly. Takayuki Sugiura, head of the Japan Hackers Association, told TBS that a successful attack could allow a server to be taken over and data to be stolen, encrypted or destroyed, and that a ransom demand was likely. [ 2 , 3 , 14 ]
Abroad, the US National Security Agency told all organisations on 21 October to act immediately, according to Sankei. Asahi said the agency advised those that could not act at once to take systems offline, and that the FBI warned on X that sensitive data and networks could be compromised. The UK's National Cyber Security Centre asked organisations to respond as soon as the fix was published, and France's government cyber agency issued an emergency alert, Sankei reported. [ 9 , 14 ]
Reuters, as cited by Sankei and Nippon TV, reported that Finland's government ICT agency blocked the government's public website as a precaution. The Netherlands' National Cyber Security Centre cut its own site off from the internet as a precaution. Sankei said the Rotterdam port authority also closed its website, which appeared to be a response to the flaws. Yahoo! News Japan said access to a Paris police website was lost. [ 5 , 8 , 9 , 16 ]
In Japan, Nikkei reported that the national bankers' association had confirmed no effect on interbank settlement. Shizuoka Bank suspended internet banking, Mizuho Bank held temporary maintenance, and Daiwa Securities suspended web services including account opening. Keihan Holdings suspended its website, and Japan Airlines stopped some site functions while saying passenger bookings and flights were not affected. Shopping-site service BASE said it was doing emergency maintenance and had found no unauthorised access. Asahi said some sites were still closed on the morning of 22 October. [ 12 , 14 ]
Why it matters
PHP is said to be used by about 70% of the world's websites, so the flaws put many sites at risk of takeover or data theft, according to Japanese outlets. Banks, railways, an airline and government bodies suspended some services while they prepared to apply the fix.
Key facts
- PHP is described as used by about 70% of websites worldwide; its developers announced on 21 October that serious flaws had been found. [ 2 , 6 , 8 ]
- The PHP development team released a fix for two serious flaws that could lead to unauthorised external operation, and asked users to update quickly. [ 8 , 14 ]
- Japan's National Cybersecurity Office and the Information-technology Promotion Agency urged prompt action. [ 2 , 3 ]
- The US National Security Agency asked all organisations to act immediately; the UK's National Cyber Security Centre asked organisations to act as soon as the fix was published. [ 9 , 14 ]
- The Netherlands' National Cyber Security Centre cut its own website off from the internet as a precaution, and Finland's government ICT agency blocked the government's public website. [ 5 , 9 ]
- In Japan, Shizuoka Bank suspended internet banking, and Daiwa Securities and Japan Airlines suspended some web functions. [ 12 ]
Confirmed by several sources
- Two serious vulnerabilities were found in PHP, and a fix was released on 21 October Japan time. [ 8 , 14 ]
- The Netherlands' National Cyber Security Centre temporarily cut its website off from the internet as a precaution. [ 5 , 9 , 13 ]
- Finland's government ICT agency blocked the government's public website as a precaution, according to Reuters as cited by Sankei and Nippon TV. [ 8 , 9 , 16 ]
- The US National Security Agency told organisations to act, and the UK's National Cyber Security Centre urged organisations to respond once the fix was published. [ 9 , 14 , 16 ]
- Several Japanese companies suspended web services as a precaution. [ 2 , 12 ]
Still unclear
- How the flaws arose and the details of how they were discovered. Nippon TV said the circumstances and cause had not been made clear.
- Whether the flaws were found with the help of AI. Only the headline of the Bloomberg report carried by TBS says so; its summary does not explain.
- Whether the Rotterdam port authority closed its website because of the PHP flaws. Sankei said the closure appeared to be a response to the flaws; it did not state this as fact.
- What the Japanese prime minister said. A TBS headline refers to an unusual appeal by the prime minister, but the available text gives no detail.
What local media are saying
Timeline, local time
- Livedoor News publishes a report on Japan's National Cybersecurity Office urging prompt action over a PHP flaw. [ 1 ]
- TBS reports that some Japanese firms have suspended web services and that the fix is due at 23:00 Japan time. [ 2 ]
- NHK reports that the Information-technology Promotion Agency urged prompt action. [ 3 ]
- TBS reports that the Netherlands cut its cyber security centre website off, and that the UK and EU member states issued warnings. [ 5 ]
- Nikkei reports suspensions at banks, brokers, railways and Japan Airlines; the national bankers' association says interbank settlement is not affected. [ 12 ]
- Asahi reports that some sites were still closed on the morning of 22 October. [ 14 ]