Sanae Takaichi warns of PHP flaws and advises patches

Japanese Prime Minister Sanae Takaichi issued a public warning regarding two critical vulnerabilities discovered in the PHP programming language.

Urgent Patching and System Shutdowns

The vulnerability, which affects a significant number of web servers globally, requires immediate technical intervention. Takaichi instructed administrators to apply the necessary security patches, which were scheduled for release at 11:00 p.m. local time on October 21. If immediate updates are not feasible, the government has recommended that organizations temporarily suspend their web services to prevent potential exploitation. According to reports from Fuji TV, several public and private entities, including parts of the Ministry of Health, Labour and Welfare, the Sapporo municipal government, and Shizuoka Bank, have already taken their websites offline or entered emergency maintenance mode.

Security Risks and Exploitation Patterns

The PHP flaws, recently identified with the assistance of artificial intelligence, pose a high risk of remote code execution. Experts warn that if systems remain unpatched, attackers can gain full control over servers. Paulo Cardoso do Amaral, a professor at the Católica Lisbon School of Business and Economics, noted the severity of the situation, stating:

"업데이트가 설치되지 않아 취약점이 남아 있다면, 공격자는 이를 이용해 시스템을 다운시킬 수 있습니다."

Paulo Cardoso do Amaral, Católica Lisbon School of Business and Economics

Japan’s heightened response is linked to the country’s extensive reliance on PHP across its public sector, corporate infrastructure, and gaming industry. Previous incidents in 2024 revealed that systems utilizing Japanese and Chinese character encodings were particularly susceptible to remote code execution attacks. These vulnerabilities have previously been exploited by ransomware and hacking groups targeting Windows-based PHP servers within Japan.

Rising Cyber Threats in Japan

The government’s rapid response follows a series of cyber-related tensions involving international hacking organizations. In May, Japanese authorities arrested a member of “Kirin,” a Russia-linked hacking collective. Following the arrest, the group issued retaliatory warnings, characterizing Japan as having poor cybersecurity and suggesting that attacks against Japanese government and corporate entities would likely increase. This history of targeted strikes has contributed to the administration’s assessment that the current PHP vulnerability constitutes an emergency situation for the nation’s digital infrastructure.