PHP 高危漏洞全球应急：日本银行、航空等密集下线网络服务，尚无确认攻击或数据泄露

Japanese companies from banks to airlines took down digital services to shield themselves from flaws in internet software, one of the starkest examples of the chaos wrought by the discovery of vulnerabilities in the commonly used PHP programming language.

Tokyo joined governments from London to Canberra and Washington that scrambled Thursday to assess the potential damage after the developer of PHP revealed the holes and released updates to plug them. In a post on X, Prime Minister Sanae Takaichi urged organizations using PHP — including government agencies — to install security patches as quickly as possible, echoing similar calls by leaders around the world.

The impact was particularly pronounced in Japan, highlighting the country’s persistent struggle to secure and upgrade aging digital infrastructure. A host of internet services went offline on Thursday, blocking people from opening investment accounts, opening digital boarding passes or accessing customer-service websites.

Tokyo halted some website pages for the finance and health ministries. Still, no attacks have been confirmed to have exploited the PHP vulnerabilities, Chief Cabinet Secretary Minoru Kihara told a regular news conference.

US Urges Fix for Widely Used Software After Critical AlertsSouth Korea Cyber Agency Urges Security Updates for PHPFinland Takes Down Websites as Precaution Due to Vulnerabilities

PHP is one of the web’s most widely deployed technologies, underpinning millions of websites. Any vulnerability could therefore cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches. Taking sites offline means attackers can’t reach and exploit the flaw while it’s being fixed.

Many countries mobilized as a precaution. Finland started pulling government websites offline on Wednesday. Dutch national and local government websites were also taken down.

In Japan, Mizuho Financial Group Inc.’s bank and security arms halted services and said they were taking emergency steps to improve security. Regional lender Shizuoka Bank suspended its website and app, while Mitsubishi UFJ Financial Group Inc. companies halted some online services.

ANA Holdings Inc.’s All Nippon Airways disabled services including boarding pass issues via Apple Wallet, saying it’s found no evidence of a breach but has taken the precautionary step because some of its systems use PHP. Japan Airlines Co. took down some webpages and services, citing system maintenance, while East Japan Railway Co. halted some web services and Seven-Eleven Japan Co. took down a customer-support website, according to a spokesperson.

The breadth of the response in Japan offers a glimpse into how aging and often invisible pieces of software embedded in digital infrastructure can ripple throughout people’s daily lives. The country is particularly vulnerable due to its heavy reliance on legacy software and companies’ reliance on external tech providers.

PHP has fallen in popularity as the programming language of choice, sitting at around 18% usage among respondents in Stack Overflow’s developer survey. But it remains ubiquitous in Japan, powering a large share of web applications, e-commerce stores and WordPress content — with many companies using out-of-date versions.

In a survey of companies listed on the Tokyo Stock Exchange, 70% of respondents running PHP software said they were using out-of-date software whose support had ended, indicating a large pool of systems that may be exposed.

A chronic shortage in cybersecurity manpower may also be exacerbating the problem.

Japan has a shortage of some 110,000 cybersecurity workers, according to the Ministry of Economy, Trade and Industry, citing a study by the nonprofit group ISC2. Since many are concentrated in IT and software companies, retail, finance or transportation companies are reliant on outsourced help to identify exposure and conduct patches. That sometimes means the easiest and safest thing for companies to do is to take consumer-facing services offline.

Japan continues to struggle with inadequate infrastructure and information-technology practices that make security maintenance increasingly complex and disruptive, which in turn reinforces the reluctance to make changes, according to Lisa Landau, chief executive officer of Tokyo-based cybersecurity company ThreatLight.

Vulnerabilities keep accumulating, even as AI expands the scale of targeted attacks and rapidly transforms the cybersecurity front. The real risk is that Japanese companies’ ability to adapt, investigate, and respond hasn’t kept pace with the threats they’re facing, she said.

“Why does routine security maintenance require interrupting the business?” she said. “When maintaining security becomes a threat to business continuity, the problem is much bigger than any individual vulnerability.”