Japan to simulate AI-powered cyberattacks amid global PHP vulnerability crisis

Japan announced on October 23, 2026 that it will establish an AI-driven team to simulate cyberattacks, aiming to identify system weaknesses as critical PHP vulnerabilities roil global networks. Disclosed security flaws in PHP prompted millions of exploit attempts worldwide, forcing banks, airlines, and government agencies to pull services offline. SoftBank suspended its mobile emergency disaster alert system for 30 million users to apply patches, while governments in the US, UK, South Korea, and China issued emergency advisories.

PHP vulnerability crisis

• ▪Censys identified approximately 36.7 million internet-facing services running potentially affected PHP versions in an October 22, 2026 snapshot.
• ▪PHP developers released emergency security patches on October 21, 2026 for long-standing vulnerabilities uncovered using artificial intelligence.
• ▪On October 23, 2026, PHP advised users to temporarily disable its session upload progress feature to mitigate remote code execution risks until the next bugfix release.
• ▪Two critical vulnerabilities in the PHP programming language, collectively referred to as PHP2Shell, allow remote code execution without authentication on exposed servers.
• ▪Qualys found 167 million PHP package installations across 12,000 organizations, with 73% deployed on internet-facing assets.

Global website disruptions

• ▪Japanese organizations including Nomura, Mitsubishi UFJ Financial Group, ANA, East Japan Railway, the Ministry of Finance, National Tax Agency, and Meteorological Agency temporarily suspended online services.
• ▪Banking, airline, rail, tax, and government online services were temporarily shut down from Tokyo to Helsinki as precautionary security measures against PHP vulnerabilities.
• ▪In the United Kingdom, 32 government services as well as websites for the BBC, Internet Archive, Wikipedia, and 4Chan experienced temporary outages during system maintenance.
• ▪Critical security flaws in PHP prompted millions of automated hacking attempts on government and corporate websites worldwide.

Japan AI cyberattack simulation

• ▪Nobuo Miwa, president of cybersecurity firm S&J Corp, criticized the Japanese government's response to the PHP vulnerability as too slow.
• ▪Japanese industry minister Ryosei Akazawa stated on October 23, 2026 that defenders must adopt an attacker mindset and use AI to stay ahead of cyber threats.
• ▪Trend Micro CEO Eva Chen stated that attackers are likely targeting Japanese businesses due to detailed records accessible via AI despite language barriers.
• ▪On October 23, 2026, Japan announced plans to set up an AI-driven team to simulate cyberattacks and proactively identify technology system weaknesses.

SoftBank emergency alert suspension

• ▪SoftBank stated that smartphone users can still access earthquake warnings through alternative applications, including an app provided by Yahoo.
• ▪During SoftBank's alert system suspension, its 30 million smartphone customers will not receive direct early warnings for earthquakes, tsunamis, or evacuation notices.
• ▪Japanese mobile carrier SoftBank announced on October 23, 2026 that it is suspending its mobile emergency alert system while performing maintenance to fix a PHP vulnerability.

Cybersecurity response measures

• ▪The United Kingdom's National Cyber Security Centre issued 50,000 alerts to affected organizations following the disclosure of critical PHP flaws.
• ▪China's industry ministry urged organizations to inspect their systems, upgrade PHP versions, strengthen monitoring, and change passwords and keys.
• ▪The United States National Security Agency urged immediate patching across government agencies, warning that PHP2Shell allows attackers to seize web servers and steal sensitive data.
• ▪South Korea activated emergency response measures and raised its private sector cybersecurity alert level on October 22, 2026 in response to the PHP flaws.