_2.jpg)
Sony Group (TYO: 6758), Nojima (TYO: 7419) and Bandai Namco Holdings (TYO: 7832) were among the Japanese companies that took online services offline while dealing with a vulnerability in the PHP programming language, the Yomiuri Shimbun reported on October 23.
The disruption reached retail, transport and finance. Companies chose to suspend web services before any harm occurred, putting the protection of customer data ahead of convenience as cyberattacks become more frequent.
Sony launched emergency maintenance on the night of October 21 at Sony Store, the online shop selling the group's smartphones and game consoles. Some services were unavailable until around 7pm the next day. The group also shut down the official website of its semiconductor subsidiary.
Electronics retailer Nojima took its official website and online shopping site down at 8:30pm on October 21. It brought them back on the morning of October 22 once it had confirmed they were secure. Bandai Namco began maintenance at about 10pm on October 21, and by 5pm on October 22 parts of its amusement arcade online services and online store were still suspended.
Central Japan Railway halted bookings for the private booth workspaces it operates at major Tokaido Shinkansen stations.
Takahashi, of Tokyo-based security company Trend Micro, said applying software fixes takes some time. He added that the gap in recovery between companies came down largely to whether they had organised staff with the business impact in mind, and that firms which had not prepared for such a scenario would struggle to respond quickly.
Banks and other financial institutions restricted some web services. Payment functions such as deposits, withdrawals and transfers were not affected. Mitsubishi UFJ Morgan Stanley Securities suspended online identity checks and other services from the evening of October 21.
Tokio Marine & Nichido Fire Insurance stopped displaying its website from the early hours of October 22. A spokesperson said the company had emergency patches ready but went offline to avoid damage while the work was carried out. The insurer described the decision as a difficult one. It said it took precautionary action to keep customer data safe and to prevent a prolonged outage.
Another financial industry source said their systems had stayed offline on vendor instructions until the vulnerability was fixed. The source added that preventive shutdowns to stop customer data leaks would become more important
'Backbone of the web': What is PHP and how has it raised AI hacking fears?
EXPLAINER
As governments and corporations alike scramble to install a patch to fix fundamental security flaws in a programming language that helps run roughly 70 percent of the world's websites, here's what you need to know about how AI has helped bring these critical vulnerabilities to light.
Issued on: 22/10/2026 -
By: FRANCE 24
Artificial intelligence has found critical security flaws in a major programming language called PHP, with many websites taken offline Thursday as organisations worldwide scramble to fend off would-be hackers.
As AI's fast-advancing capabilities fuel concern over the increased risk of cyberattacks, here are some questions and answers about the situation:
What is PHP and how widely used is it?
Created in the early 1990s, PHP is a computer programming language that helps run an estimated 70 percent of the world's websites.
It is "a backbone of the web", according to security firm Wiz Research, which says it used AI to find vulnerabilities hidden in PHP for more than a decade.
PHP – a name that originally stood for Personal Home Page – underpins popular web design platforms, meaning the flaws could allow hackers to break into various sites, from online stores to government services.
A fix was released Wednesday, with the PHP Foundation telling the tech departments of companies and organisations around the world: "If you run PHP, it is imperative that you update now."
That has resulted in a slew of apps and websites – from the Paris police website to a Pokemon sleep tracker – going dark as developers work to protect their underlying code from hacks.
China's industry ministry said Thursday organisations and users should immediately conduct a comprehensive inspection of their technology systems and upgrade to the latest secure PHP version.
The ministry also recommends strengthening cybersecurity monitoring and timely changing of accounts, passwords and keys, it added.
How did AI find the flaws?
Cutting-edge AI models, such as those from US giants OpenAI and Google, were used by Wiz and other groups to uncover PHP's weak spots in August.
This was kept under wraps while a fix was developed.
OpenAI called the flaws "one of the most impactful vulnerabilities in recent memory", adding that it "marks a new phase, where AI can find security bugs with internet-scale impact".
WATCH MOREConcerns mount over artificial intelligence as Silicon Valley sees AI boom
Separately to Wiz, security firm Calif found the flaws as part of an OpenAI-funded audit of PHP's code.
"The trouble with tools like AI is that the moment all the information's out there, people can weaponise it very, very quickly," Steve Kerrison, senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP.
"That's why everybody's acting with such urgency to respond to this issue."
Have sites already been hacked?
"Taking websites offline does not necessarily mean they have been hacked. It can be a responsible measure to protect systems while security updates are applied," said Dimitrios Salampasis from Australia's Swinburne University of Technology.
So far "the evidence that security researchers are seeing is that nobody was actively performing attacks using the techniques available", Kerrison said.
Larger institutions, from government agencies to news outlets, should be able to fix their websites relatively quickly – but others may be left vulnerable.
"There are sites, systems and people out there who will have no idea about this and still won't for days, weeks and months," Kerrison warned.
That may include user-run blogs that could be used to spread computer viruses, spam people or distribute malicious content.
Could there be other consequences?
A data breach could affect customers in the future if their personal information is used in so-called "phishing" attacks, where someone is tricked into revealing their password to an online service.
The complex and interlinked nature of online systems, which often use third-party interfaces, means some vulnerabilities could remain even after the problem is fixed.
If the third parties use PHP, "then even though you patched yourself ... you're still unsecure", said Rahat Masood, senior lecturer in cyber security at the University of New South Wales, Sydney.
PHP isn't everything, however – strong cybersecurity measures should include several layers of defences, Kerrison said.
(FRANCE 24 with AFP and Reuters)
No comments:
Post a Comment