News Connect あなたと経済をつなぐ5分間 #ニュースコネクト · News
【10月23日】PHP脆弱性、なぜ日本で影響拡大？ 利用率9割とAIが変えるサイバー攻防
A critical vulnerability discovered in PHP in October 2026 prompted a sweeping wave of emergency maintenance across Japan, with organizations ranging from Mizuho Bank and JAL to Sony, Bandai Namco, and the Japan Tourism Agency temporarily suspending services. Japan's PHP usage rate stands at 92.4%—far above the global average of 69.3%—making the country uniquely exposed whenever a flaw emerges in the language. Compounding the urgency, AI tools have dramatically lowered the barrier to writing exploit code, leaving companies far less time to patch than they once had.
Listen to this episode Go to the show page
What this episode answers
What kind of programming language is PHP, and why is it used so widely around the world?
PHP is a server-side programming language that handles the backend processing of websites—such as logins and form submissions—and its open-source, free-to-use nature has made it a staple of web development worldwide.
What dangers could the newly discovered PHP vulnerability create?
If exploited, the vulnerability would allow hackers to remotely control servers, potentially causing data leaks and service outages; Hong Kong's cybersecurity monitoring body rated the risk as 'extremely high' and confirmed that real-world exploitation had already been observed.
Why were so many organizations in Japan affected?
Japan's PHP usage rate of 92.4% vastly exceeds the global average of 69.3% and the US figure of 45.9%, a gap driven by the country's WordPress adoption rate of 88.3%—more than double the global average of around 40%—meaning a single vulnerability in PHP forces a simultaneous response across virtually every sector of the economy.
What changes has AI introduced to the world of cyberattacks?
Where creating exploit code from vulnerability information once required specialist knowledge and significant time, AI can now generate attack code almost instantly, sharply compressing the window companies have to apply a patch before attacks begin.
Were the companies and agencies that suspended their services actually attacked?
No—the suspensions were not the result of successful attacks; ANA stated its shutdown was 'not due to a cyberattack or data breach,' and the government confirmed it had 'received no reports of damage,' with the closures representing a precautionary decision to halt services before any harm occurred.
What Is PHP?
PHP is one of the most widely used server-side programming languages on the web. Whenever users log in to a website or submit information through a form, it is languages like PHP running on the server that process those requests behind the scenes. Because PHP is open-source—free for anyone to use—and relatively approachable for developers, it has become a foundational tool in web development around the world.
The Vulnerability and Japan's Response
In October 2026, a serious vulnerability was discovered in PHP. If left unpatched, the flaw could allow hackers to remotely control an affected server, leading to data breaches or complete service outages. Hong Kong's cybersecurity monitoring authority rated the risk as 'extremely high' and reported that the vulnerability had already been actively exploited in the wild.
Japan's response was swift and broad. Prime Minister Takai (高井首相) took to X on October 21 to urge website operators using PHP to apply the available patch without delay. A wide range of organizations followed: Tokio Marine & Nichido, Nippon Life Insurance, Mizuho Bank, Resona Holdings, Daiwa Securities Group, Sony, JAL, ANA, SEGA, Cygames, Bandai Namco, and Sakura Internet all suspended portions of their services or carried out emergency maintenance. Government websites—including that of the Japan Tourism Agency—also went into temporary maintenance mode.
Why Japan Was Hit So Hard
The scale of disruption in Japan comes down to one number: 92.4%. According to data from an IT consulting firm, that is the share of Japanese servers running PHP, measured by server location. The figure dwarfs the global average of 69.3% and the United States' 45.9%.
The explanation lies in WordPress. WordPress is a content management system that lets organizations publish articles and images to websites without deep technical knowledge—and PHP runs underneath every WordPress installation. Japan's WordPress usage rate is 88.3%, more than double the global average of roughly 40%.
The result is a structural vulnerability: a single technology so deeply embedded across banking, aviation, entertainment, and government that one newly discovered flaw triggers a nationwide, cross-sector scramble. This episode made that structure impossible to ignore.
How AI Has Changed the Cyberattack Timeline
This incident introduced a second, newer complication. Before PHP's developers could release the vulnerability details alongside a fix, multiple third parties had already posted information online that was sufficient to identify the flaw.
Nishikawa Akira (西川明), an engineer at Cybersecurity Cloud, was direct about the implication: 'Once you can see what was fixed, you can now use AI to generate attack code.' In the past, even if an attacker obtained vulnerability information, turning it into working exploit code required deep expertise and considerable time. AI has largely removed both of those barriers, compressing the safe window between public disclosure and active exploitation. That compression is the direct reason organizations chose to pull their services during business hours rather than wait for a quieter maintenance window.
The Case for Precautionary Shutdown
A critical distinction runs through the entire episode: suspending a service is not the same as being attacked. ANA explicitly stated that its downtime was 'not due to a cyberattack or data breach,' and the government confirmed it had 'received no reports of damage.'
Nishikawa called the decisions by companies and agencies to halt services mid-day 'appropriate.' What spread across Japan was not a wave of successful intrusions but a wave of deliberate, precautionary decision-making—organizations choosing to accept the cost of temporary downtime in exchange for avoiding the far greater cost of a breach. The episode is, at its core, a story about what responsible incident response looks like when AI has fundamentally changed the clock.
Takeaways
- Japan's PHP usage rate of 92.4%—driven by a WordPress adoption rate of 88.3%, more than double the global average—meant a single vulnerability forced simultaneous emergency responses across banking, aviation, entertainment, and government.
- AI has eliminated the specialist knowledge and time once required to write exploit code, dramatically shrinking the window between a vulnerability's disclosure and a potential attack.
- The widespread service suspensions were precautionary, not the result of successful attacks, and security experts assessed the rapid shutdown decisions as appropriate.
This article is edited from a machine transcript of the first 30 minutes of the episode. It is not an official summary — please listen to the episode itself.