A serious PHP vulnerability has been disclosed, triggering widespread effects around the world. As advances in AI technology expose a problem that had remained latent for years, disruption in Japan is spreading, including the suspension of services operated by financial institutions and government websites.
A remote code execution vulnerability in PHP, the programming language used by approximately 70% of the world's web servers, has been identified as being at the highest level of urgency, and the development group released an emergency patch on 21 October. The vulnerability is said to potentially allow attackers to take control of servers remotely without authentication, and its potential impact is considered extremely broad.
The fact that the vulnerability had remained hidden deep within the code for many years has attracted attention. It is reportedly the first time that security companies on the AI defense side have detected it using advanced AI models such as OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. Some have pointed out that advances in AI are exposing vulnerabilities that humans had overlooked at roughly the same time, expanding opportunities for exploitation.
In Japan, parts of the online services of MUFG Bank, The Shizuoka Bank and Daiwa Securities were suspended, while services including Nico Nico Douga, pixiv, Uma Musume and Granblue entered emergency maintenance. Access-blocking measures also spread to the official websites of government institutions, including the Ministry of Finance, the Japan Meteorological Agency and the National Tax Agency, as well as Sapporo City's official website. The situation developed into an unusual response, with Prime Minister Takaichi Sanae (高市早苗) calling for the patch to be applied promptly.
The impact also spread to government institutions and public services in the United States and Europe. The White House said it would work with others to protect critical infrastructure, while NASA warned that countermeasures against the vulnerability were essential and urged consideration of taking its own systems offline. Government websites were also suspended one after another in European countries, affecting the provision of information and the operation of public services. OpenAI has warned that discoveries of similar vulnerabilities will surge over the next several months.