TOKYO — Websites belonging to major Japanese banks, government ministries, and prominent businesses were taken offline for emergency maintenance on Thursday, following the disclosure of critical security flaws affecting PHP, a programming language used by approximately 70% of websites worldwide.

The sudden service suspensions came in response to international cybersecurity warnings regarding two severe vulnerabilities collectively dubbed "php2shell." The flaws allow unauthenticated attackers to execute arbitrary code on affected servers or extract sensitive process memory, posing an unprecedented risk to digital infrastructure.

Immediate Government and Corporate Response

In an urgent message posted on X late Wednesday, Prime Minister Sanae Takaichi strongly urged website administrators to check whether their platforms rely on PHP. She called on operators to immediately apply security patches upon their release at 11:00 p.m. Wednesday or to temporarily suspend web services until safety could be verified.

Chief Cabinet Secretary Minoru Kihara announced during a Thursday news conference that public access to certain contents on the websites of the Ministry of Health, Labor and Welfare and the Ministry of Finance was temporarily halted.

“To prevent damage resulting from this vulnerability, we understand that government ministries and critical infrastructure operators have been taking precautionary measures, including carrying out maintenance on their websites,” Kihara said. He added, however, that no actual damage or breaches had been reported as of Thursday.

The precautionary shutdowns extended across the private sector and local governments. Major financial institutions, including MUFG Bank, Mizuho Bank, and Japan Post Bank, restricted portions of their web services. High-profile commercial services — such as the Niconico streaming platform, websites operated by electronics manufacturer Sharp, NTT Docomo’s "My docomo" service, and the Hankyu corporate website — were also temporarily taken offline.

Discovery by Wiz and OpenAI Using AI

The severity of the situation stems from the ubiquity of PHP, which serves as the foundational scripting language behind popular content management systems such as WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki.

While one of the two vulnerabilities was initially discovered by the PHP Foundation in 2024, it was not heavily prioritized until August of this year. At that time, researchers from Wiz Research, California-based teams, and OpenAI identified it alongside a secondary flaw using artificial intelligence to detect and analyze potential software bugs.

The collaborative research revealed that these critical flaws had remained hidden within the system for up to a decade. On Tuesday, the PHP Foundation announced that emergency security patches would roll out the following day.

In a blog post published Wednesday, Wiz Research explained the gravity of the situation:

“The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys, and certificates belonging to other requests or the server itself.”
OpenAI echoed these concerns on its website, labeling the discovery as one of the most impactful security issues in recent memory due to PHP’s massive global footprint.

“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” OpenAI stated.

Pre-Disclosure Exploitation Concerns

Compounding the crisis, threat intelligence agencies revealed that malicious actors may have targeted the vulnerability before public disclosure.

Amazon Threat Intelligence reported detecting an attempt to exploit the flaw on October 17, four days before the official advisory and patch release. Additional exploitation attempts were tracked on Wednesday, according to an AWS blog post.

“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Amazon Web Services noted.

Amazon warned defenders not to assume that safety began on the public disclosure date, cautioning that compromises involving php2shell may have predated the official advisory.

As institutions across Japan work around the clock to verify updates and secure their networks, cybersecurity experts continue to urge global organizations to audit their PHP environments immediately to mitigate potential fallout.

[ⓒ Global Economic Times. 무단전재-재배포 금지]