Japan plans AI cyberattack drills as PHP flaws force SoftBank to suspend emergency alerts

Japan said on Friday it will set up a team to simulate cyberattacks using AI to identify weaknesses in technology systems, as governments and companies around the world shut down websites after artificial intelligence uncovered critical flaws in the PHP programming language (Telegraph India / Reuters; Malay Mail). The flaws — collectively called PHP2Shell, found by teams at OpenAI, Google-owned Wiz and cybersecurity firm Calif and patched by the PHP Foundation on Wednesday — affect around 70 per cent of the world’s websites, and the US National Security Agency has told organisations to patch immediately or pull vulnerable systems offline (Malay Mail; The Nation).

“An attack can succeed by getting through just one hole … for that reason it’s important we shift our mindset and think from the perspective of the attacker,” Japanese industry minister Ryosei Akazawa said on Friday, adding: “Defenders also need to make use of AI and respond proactively, staying one step ahead” (Telegraph India / Reuters).

The scale of the disruption was underscored on Friday when Japanese mobile carrier SoftBank suspended its emergency alert system for mobile users during maintenance to address a PHP vulnerability, meaning customers will not receive early earthquake or tsunami warnings, or disaster and evacuation information, while the system is offline (Telegraph India / Reuters). Emergency shutdowns from Tokyo to Helsinki have hit banking, airline, rail, tax and government services, and Cloudflare’s CEO said on X the company’s network had seen millions of exploit attempts in the past couple of days (Telegraph India / Reuters; The Nation).

Services that temporarily suspended online operations in Japan include:

• SoftBank’s emergency alert system (early earthquake and tsunami warnings, disaster and evacuation information) — during maintenance to address a PHP vulnerability
• Brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway (JR East)
• Japan’s Ministry of Finance, National Tax Agency and Meteorological Agency

“With PHP behind such a vast share of the web, the exposure could reach almost everywhere people spend money online,” said Nigel Green, CEO of financial advisory firm deVere Group, warning that booking platforms, marketplaces and ticketing sites could be holding card details on vulnerable systems (The Nation).