Bank, business and ministry websites halted after PHP vulnerabilities announced

Banks, businesses and government ministries in Japan took websites offline for maintenance on Thursday after critical security flaws were announced in a programming language used across 70% of sites worldwide.

In a message posted on X on Wednesday night, Prime Minister Sanae Takaichi urged people to check whether the websites they maintain use the programming language PHP, and to apply the update immediately once it became available at 11 p.m. on Wednesday — or to temporarily suspend web services until they could.

Public access to some content on the websites of the Health, Labor and Welfare Ministry and the Finance Ministry was temporarily suspended, Chief Cabinet Secretary Minoru Kihara said at a news conference on Thursday.

“To prevent damage resulting from this vulnerability, we understand that government ministries and critical infrastructure operators have been taking precautionary measures, including carrying out maintenance on their websites,” Kihara said, adding that there had not yet been any reports of damage.

Warnings were issued by international agencies including Japan’s National Cybersecurity Office, the U.S. National Security Agency and CERT-EU, the European Commission’s cybersecurity body.

The Niconico streaming service, sites run by electronics-maker Sharp, NTT Docomo’s “My docomo” service and the Hankyu website were among the online services temporarily suspended on Thursday. Local government websites were also restricted between Wednesday and Thursday, as were various banks’ web services including MUFG Bank, Mizuho Bank and Japan Post Bank.

A screenshot of the Shizuoka Bank website on Thursday shows the site temporarily shut down to deal with the PHP security vulnerabilities. | Shizuoka Bank

One of the two vulnerabilities in PHP — the scripting language behind popular content management system platforms including Wordpress, Drupal, Joomla and Wikipedia’s MediaWiki — was first discovered by the PHP Foundation in 2024. But it was not prioritized until August of this year, when it was identified together with the other vulnerability by teams at Wiz Research, Calif and OpenAI. On Tuesday, PHP announced that a security patch would be available the following day for the vulnerabilities, collectively named php2shell.

“The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory,” Wiz said in a blog post Wednesday. “That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.”

Using artificial intelligence to identify and collect potential bugs, the teams found vulnerabilities that had existed within the system for up to a decade, which could be exploited to “take control of affected servers, steal sensitive data, and deface the websites running on them,” Wiz explained.

On its own website, OpenAI said on Wednesday: “Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory.

“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” the post said.