Australia edition
Canada edition
France edition
Germany edition
India edition
Italy edition
Japan edition
Korea edition
Netherlands edition
Spain edition
Taiwan edition
U.K. edition
U.S. editionPHP’s developers released, on the night of the 21st Japan time, a fixed version addressing 2 serious vulnerabilities. According to Asahi Shimbun, Prime Minister Takaichi, in an X post that night titled “An Urgent Request,” asked people to check whether they use PHP and to apply the patch, and said that temporarily shutting down a site is an option if that is difficult. According to ITmedia, some engineers praised it, saying it gets through to management. According to NHK, through the 22nd, temporary suspensions of site publication followed one after another at banks, railways, local governments and elsewhere. According to Mainichi Shimbun, the Metropolitan Police Department on the 22nd gathered 59 critical infrastructure operators for an emergency meeting and asked them to use the fixed version, among other things. Jiji Press reported 81 participants. According to Mainichi Shimbun, the number of suspicious accesses recognized this year exceeded 13,000.
PHP underlies many websites, and if older, unfixed versions remain, there is a risk of being taken over from outside. With the prime minister herself making the appeal, more organizations chose to shut down sites as a management decision, not only a technical-department one.
Banks and booking sites you use often may be temporarily unavailable. Check official notices, and do not fall for emails that steer you to look-alike sites while a service is down.
The engineers’ reactions that ITmedia reported praise the prime minister’s post for moving management and speeding decisions on applying patches and shutting down sites. The view is that, in the first response to a crisis, a message that reaches widely was useful.
On the other hand, criticism also appeared online that a prime minister giving technical instructions on social media should instead go through press conferences or the responsible ministry. Some also point out that simultaneous shutdowns spread with the procedures unclear and caused confusion among users.
That a fixed version was released and that many organizations moved to shut down or update is certain. How much actual intrusion damage there has been in Japan is not yet visible. Today we want to watch the resumption status of the suspended sites and how the government explains whether there was damage.
Asahi Shimbun (the prime minister’s X post and government advisory, 10/22) · ITmedia (reaction to the prime minister’s request, 10/22) · Mainichi Shimbun (Metropolitan Police Department emergency meeting, 10/22) · Jiji Press (meeting with critical infrastructure operators, 10/22)
Serious Flaw in PHP: Prime Minister Urges “Immediate Action” on X, Tokyo Police Hold Emergency Meeting With 59 Critical Infrastructure Operators
After a fixed version of PHP, widely used on websites around the world, was released, an unusual appeal from the prime minister was followed by a string of temporary shutdowns of bank, railway and municipal sites.
A serious vulnerability has been found in the PHP programming language, and its developers released a fixed version on the night of the 21st, Japan time. According to Asahi Shimbun, Prime Minister Sanae Takaichi, in a post that night on her own X account titled “An Urgent Request,” urged people to check whether the websites they publish use PHP and to apply the patch (the fix program) at once. She said that where that is difficult, temporarily taking the site down is also a way to reduce risk. ITmedia reported that it is unusual for a prime minister to call directly on social media for technical action, and that some engineers on the front line praised it for getting a sense of crisis across to management.
According to NHK, through the 22nd a string of companies and government bodies temporarily suspended publication of their websites, with the effects spreading to bank account-opening services, railway company sites and more. According to Mainichi Shimbun and Jiji Press, the Metropolitan Police Department on the 22nd gathered security officials from 59 critical infrastructure operators in Tokyo for an emergency meeting and asked them to use the fixed version of PHP and, where they cannot update, to take their sites down. Jiji Press reported a total of 81 participants. The meeting was held under the framework of the department’s Cyber Terrorism Countermeasures Council, and participants were also urged to encrypt data, disconnect backups, and coordinate with the police toward active cyber defense. According to Mainichi Shimbun, the number of suspicious accesses recognized this year has exceeded 13,000, a record high.