PHP？ハッキング問題で日経平均は6万2000円割れ？
AI-discovered PHP vulnerabilities that had lain undetected for over a decade triggered emergency maintenance at major Japanese banks, brokerages, and public agencies on October 22. Around the same time, Microsoft revealed that the Chinese-government-linked hacker group Storm-0940 had used AI-powered tools to breach IT management firm ConnectWise. The dual shocks sent the Nikkei average plunging 1,082 yen to 61,825.
Listen to this episode Go to the show page
What this episode answers
How was the PHP vulnerability discovered, and why is it such a significant problem?
OpenAI, Google, and cybersecurity firm Wiz used AI to discover two critical PHP vulnerabilities in late August — bugs that had gone undetected by human eyes for over ten years — which could allow attackers to take full control of any PHP-based site or system. A patch was released around 22:40 JST on October 21, but Amazon disclosed that it had already observed exploitation attempts as early as October 17, four days before the fix was available.
Which Japanese financial institutions and public services were disrupted, and what is the current status?
MUFG (partially, later restored), Aomori Bank, Shizuoka Bank, Yamanashi Chuo Bank, and San'in Godo Bank all conducted emergency maintenance on October 22, as did Mizuho and Daiwa Securities; JR Kyushu's reservation app, the Ministry of Finance, My Number Card-related systems, and several game companies also suspended service, and most have since resumed.
What was the Storm-0940 breach of ConnectWise?
Microsoft announced that Storm-0940, a hacker group linked to the Chinese government, exploited Artex — an AI-based open-source penetration testing tool — to breach ConnectWise, which manages IT equipment and cloud backups for client companies, as part of a campaign targeting hundreds of organizations worldwide; even after closing the entry point, backdoors planted inside systems may require a separate detailed investigation.
What security measures should individuals prioritize right now?
The highest priority is enabling two-factor authentication on your email account and setting a unique randomly generated password for it; next, change passwords and enable two-factor authentication on major bank and brokerage accounts, and remove saved credit card information from shopping sites you rarely use.
What impact did these events have on stock prices and financial markets?
The Nikkei fell 1,082 yen to close at 61,825 — briefly touching the 61,400 range — while NASDAQ dropped 2.6% and the SOX semiconductor index fell 6.7%; Trend Micro surged roughly 40% from September levels to a high of ¥7,667, and GMO Prime Strategies hit consecutive daily limit-up closes, while the U.S. 10-year Treasury yield fell below 5% to 4.96% and Japan's 10-year JGB yield dropped from above 3.1% to 2.76%.
PHP Vulnerability: AI Uncovers a Bug Hidden for Over a Decade
PHP was created in 1994 by a Danish programmer for his personal homepage and released to the public for free; it now underpins roughly 70% of websites worldwide. WordPress runs on PHP. Unlike static pages that show the same content to every visitor, PHP handles the dynamic assembly of user-specific data — purchase histories on e-commerce sites, personalised dashboards at financial institutions, and similar content.
In late August, OpenAI, Google, and cybersecurity firm Wiz used AI to discover two critical PHP vulnerabilities that had gone undetected by human eyes for more than ten years. Exploiting either flaw could allow an attacker to take complete control of any PHP-based site or system. PHP's governing body pre-announced a patch on October 20 and released it around 22:40 JST on October 21. Amazon, however, publicly disclosed that it had already observed exploitation attempts as early as October 17 — four days before the fix became available.
Affected Services: Financial Institutions and Public Agencies Go Offline
On October 22, Mitsubishi UFJ Bank (partially), Aomori Bank, Shizuoka Bank, Yamanashi Chuo Bank, and San'in Godo Bank all conducted emergency maintenance. Mizuho and Daiwa Securities also performed unscheduled downtime. JR Kyushu's reservation app, the Ministry of Finance, My Number Card-related systems, and a number of game companies suspended service as well. Most have since resumed operations. Applying the patch is far from simple: it carries a risk of breaking existing page layouts, and the sheer volume of affected systems makes migration painstaking. For individuals running WordPress sites, the hosting provider typically handles the update on their behalf.
The Storm-0940 Breach of ConnectWise
On October 21, Microsoft announced that Storm-0940 — a hacker group linked to the Chinese government — had broken into IT services firm ConnectWise using Artex, an AI-powered open-source penetration testing tool. The intrusion was part of a broader campaign targeting hundreds of organisations worldwide. ConnectWise manages client companies' IT equipment and cloud backups; the speaker likened it to a building superintendent who holds master keys for every unit in the complex. While the entry point can be closed, any backdoors planted inside systems require a separate and thorough investigation to root out. The Chinese embassy in Washington denied involvement, but the speaker noted that Microsoft's explicit, named attribution carries significant weight.
Individual Security: What to Do First
Research suggests that 60–70% of users reuse passwords across multiple services. The single most important step is securing your email account: if it is compromised, attackers can trigger password resets on every other service you use, making recovery extremely difficult. Set a randomly generated password unique to your primary email account — such as Gmail — and enable two-factor authentication. The next priority is changing passwords and enabling two-factor authentication on major bank and brokerage accounts. It is also worth removing saved credit card details from any shopping sites you use only occasionally.
Impact on Stock Prices and Financial Markets
The Nikkei average closed its morning session at 61,825 — down 1,082 yen from the previous day — after briefly touching the 61,400 range, a substantial retreat from the 70,000-plus levels seen not long ago. NASDAQ fell 2.6% and the Philadelphia Semiconductor Index (SOX) dropped 6.7%. Security stocks told a divided story: Trend Micro climbed roughly 40% from around ¥5,000 in September to a high of ¥7,667 on October 13 (P/E approximately 31x, P/B 8.2x) and currently trades around ¥7,300; GMO Prime Strategies posted consecutive daily limit-up closes despite reporting a sharp decline in profits. The U.S. 10-year Treasury yield slipped below 5% to 4.96%, and Japan's 10-year JGB yield fell from above 3.1% to 2.76% — a level that offers some breathing room for variable-rate mortgage holders. WTI crude oil hovered near $100, gold briefly dipped below $4,000, and the yen traded around ¥156 to the dollar.
Takeaways
- AI detected two PHP vulnerabilities that had evaded human discovery for over a decade, forcing emergency shutdowns at Japanese banks, brokerages, and public agencies — and Amazon observed active exploitation four days before the official patch dropped.
- Microsoft attributed the breach of IT management firm ConnectWise — which holds privileged access to hundreds of client organisations — to the Chinese-government-linked group Storm-0940, which used an AI-powered tool, leaving potential backdoors that require ongoing investigation.
- Individuals should immediately secure their email account with two-factor authentication and a unique randomly generated password; the Nikkei's 1,082-yen plunge contrasted sharply with security plays Trend Micro (up ~40%) and GMO Prime Strategies (limit-up) posting strong gains.
This article is edited from a machine transcript of the first 30 minutes of the episode. It is not an official summary — please listen to the episode itself.