Trying to prevent hacking, they halted business too...‘PHP shock’ hits Japanese companies

【Financial News, Tokyo—Correspondent Seo Hyejin】Japanese companies that suspended online services because of a PHP security flaw are worried about the impact on sales as they are held up by the replacement and inspection of aging systems. Some shopping malls that completed inspections have shut down again, and some games have ended service because their aging systems are difficult to fix. The cumulative number of service suspensions in Japan has exceeded 500.
According to the Nihon Keizai Shimbun (The Nikkei) and the Yomiuri Shimbun on the 25th, Japanese companies began emergency inspections after a PHP patch was released on the 21st, but identifying where it is used and checking systems are taking time. IT companies are mobilizing all their staff to respond, even over the weekend.
PHP is a programming language that handles website server functions such as login verification and retrieving posts. It is also used in website-building tools such as WordPress. According to the research service W3Techs.com, it is used by 69% of websites worldwide. Exploiting this flaw could allow an outside attacker to run programs on a server to steal information or alter a website.


Cosmetics company Orbis began inspecting its online store on the night of the 21st and resumed service at midday on the 22nd. However, after a new vulnerability was discovered, it suspended service again that same day. By the evening of the 23rd, it had yet to decide when service would resume.
Bandai Namco Holdings, which is also inspecting its online store, is applying patches or replacing programs. A company representative said, “We have not yet identified the full scope of the impact.”
An analysis by cybersecurity firm Assured of posts on X found that the cumulative number of service suspensions in Japan had exceeded 500. As of 2 p.m. on the 23rd, no announcements of service resumption had been confirmed for 285 cases—about 60% of the organizations that had announced suspensions.
Yasuhiro Suzuki, who led the investigation, explained, “In some cases, it takes time to find out where PHP is being used, including within a company and by contractors; in others, software support has ended.”
Masashi Nomiyama, a partner at Deloitte Tohmatsu Cyber, also noted, “Many sites at Japanese companies use outdated software,” adding that this is “one of the reasons they are frequently targeted by cyberattacks.”
Updating is not simple either. Switching to the latest version can cause existing functions, such as payment processing and membership management, to stop working, so connected programs also need to be checked. Nobuo Miwa, president of cybersecurity firm S&J, said, “Applying a patch can cause problems with links between websites and other functions, so it takes time to check all the programs.”
Some have ended their services altogether. The travel game ‘World Quest’ shut down on the 21st, saying it was difficult to put adequate security measures in place with its old system. ‘Save My Demon World!’, which had been available since 2011, also announced its closure, saying it was difficult to respond securely with its existing equipment and practically impossible to migrate to a new environment.
A representative of one manufacturer expressed concern, saying, “If the response takes a long time, it could affect sales as well.”


The fact that there have been many service suspensions in Japan does not mean that the actual damage from hacking is greater than in other countries. Many companies and government agencies halted operations as a precaution to prevent attacks. Prime Minister Sanae Takaichi also advised organizations to consider temporarily suspending their websites if they could not apply fixes quickly.
By contrast, many companies in the US made fixes while keeping their operations running. Tufts University professor Josephine Wolff said, “Far fewer organizations in the US have taken their websites offline as a precaution than in Europe or Japan,” explaining that organizations are working behind the scenes to fix vulnerabilities and strengthen security.
Major US infrastructure companies prepared defenses even before the flaw was publicly disclosed. The vulnerability had gone undetected for more than 10 years before being uncovered during an AI-assisted verification process. Starting in August, the PHP group responsible for its management shared information confidentially with the US government and technology companies as it prepared a fix. Cloudflare, which took part in the discussions, began providing protective measures for customer websites nine hours before disclosure.
Cloudflare CEO Matthew Prince told The Nikkei on the 23rd, “We are seeing one million attack-related communications per minute.” He explained that most are communications probing for vulnerable servers and are blocked by his company’s defenses, but that servers are being compromised elsewhere.
The disruption has also affected the delivery of disaster information in Japan. Since the 23rd, SoftBank has suspended emergency alert emails for SoftBank, Y!mobile and LINEMO. According to a company announcement that day, inspections are expected to be completed on the 26th. Since users cannot receive earthquake and tsunami alerts or disaster and evacuation information through the services in the meantime, the company directed them to alternative apps.
NTT DoCoMo also suspended some transmissions, including J-Alert and disaster and evacuation information from local governments. However, it continued to send emergency earthquake early warnings and tsunami alerts.

[email protected] Seo Hyejin Reporter