Japan’s banks and airlines pull digital services offline in scramble to fix PHP flaws

TOKYO – Japanese companies from banks to airlines took down digital services to shield themselves from flaws in internet software, one of the starkest examples of the chaos wrought by the discovery of vulnerabilities in the commonly used PHP programming language.Tokyo joined governments from London to Canberra and Washington that scrambled on Oct 22 to assess the potential damage after the developer of PHP revealed the holes and released updates to plug them.In a post on X, Prime Minister Sanae Takaichi urged organisations using PHP, including government agencies, to install security patches as quickly as possible, echoing similar calls by leaders around the world.The impact was particularly pronounced in Japan, highlighting the country’s persistent struggle to secure and upgrade ageing digital infrastructure. A host of internet services went offline on Oct 22, blocking people from opening investment accounts, opening digital boarding passes or accessing customer-service websites.Tokyo halted some website pages for the finance and health ministries. Still, no attacks have been confirmed to have exploited the PHP vulnerabilities, Chief Cabinet Secretary Minoru Kihara said at a news conference.PHP is one of the web’s most widely deployed technologies, underpinning millions of websites. Any vulnerability could, therefore, cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches.Taking sites offline means attackers cannot reach and exploit the flaw while it is being fixed.Many countries mobilised as a precaution. Finland started pulling government websites offline on Oct 21. Dutch national and local government websites were also taken down.In Japan, Mizuho Financial Group’s bank and security arms halted services and said they were taking emergency steps to improve security. Regional lender Shizuoka Bank suspended its website and app, while Mitsubishi UFJ Financial Group companies halted some online services.ANA Holdings’ All Nippon Airways disabled services, including boarding pass issues via Apple Wallet, saying it has found no evidence of a breach but has taken the precautionary step because some of its systems use PHP.Japan Airlines took down some webpages and services, citing system maintenance, while East Japan Railway halted some web services and Seven-Eleven Japan took down a customer-support website.Japan’s vulnerabilitiesThe breadth of the response in Japan offers a glimpse into how ageing and often invisible pieces of software embedded in digital infrastructure can ripple throughout people’s daily lives. The country is particularly vulnerable due to its heavy reliance on legacy software and companies’ reliance on external tech providers.PHP has fallen in popularity as the programming language of choice, sitting at around 18% usage among respondents in Stack Overflow’s developer survey. But it remains ubiquitous in Japan, powering a large share of web applications, e-commerce stores and WordPress content, with many companies using out-of-date versions.In a survey of companies listed on the Tokyo Stock Exchange, 70% of respondents running PHP software said they were using out-of-date software whose support had ended, indicating a large pool of systems that may be exposed.A chronic shortage in cybersecurity manpower may also be exacerbating the problem.Japan has a shortage of some 110,000 cybersecurity workers, according to the Ministry of Economy, Trade and Industry, citing a study by the nonprofit group ISC2.Since many are concentrated in IT and software companies, retail, finance or transportation companies are reliant on outsourced help to identify exposure and conduct patches. That sometimes means the easiest and safest thing for companies to do is to take consumer-facing services offline.Japan continues to struggle with inadequate infrastructure and information-technology practices that make security maintenance increasingly complex and disruptive, which in turn reinforces the reluctance to make changes, according to Lisa Landau, chief executive officer of Tokyo-based cybersecurity company ThreatLight.Vulnerabilities keep accumulating, even as AI expands the scale of targeted attacks and rapidly transforms the cybersecurity front. The real risk is that Japanese companies’ ability to adapt, investigate, and respond has not kept pace with the threats they’re facing, she said.“Why does routine security maintenance require interrupting the business?” she said. “When maintaining security becomes a threat to business continuity, the problem is much bigger than any individual vulnerability.” BLOOMBERG