Japan’s PM Asked PHP Sites to Patch Fast or Go Offline

Japan’s Prime Minister Takaichi Sanae used her own X account on 21 October 2026 to ask everyone running a PHP website to act that night. In our translation of the post, she wrote: “If it is difficult to apply the fix patch quickly, temporarily stopping the website, for example, is also considered one effective measure to reduce the risk.” The fix for the two critical PHP flaws was due at 11 p.m. Japan time.

Her request landed in the middle of a run of data breaches at Japanese companies. Japan’s national computer emergency response team, JPCERT/CC, says it confirmed that the attackers behind that wave used AI to scan for known vulnerabilities and to attack companies through their APIs. The breach disclosures include 22,519,960 records at software maker Sourcenext, about 11.18 million at Burger King Japan and about 6.6 million accounts at car-sharing service Times Car.

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege: giving a system only the access its task needs. It teaches the general idea only and says nothing about Japan, PHP or any company in this piece.

What the Prime Minister Asked

The post went up at 21:55 Japan time, about an hour before the PHP fixes were released. It opens, in our translation, as “An urgent request to everyone, which I ask you to act on tonight.” It says the PHP security team “has issued an alert about two serious vulnerabilities” and asks site owners to “check whether the websites you publish use PHP” and to prepare to apply the patch “as quickly as possible.”

PHP is a programming language used by many websites, as the post itself notes. The post points readers to the National Cybersecurity Office’s own X account for further updates. X showed about 69 million views on the post when we read it.

What Was Posted on X

Prime Minister Takaichi Sanae’s own post, in Japanese, at 21:55 Japan time on 21 October. In our translation, she asks everyone to act that night: check whether their websites use PHP, prepare to apply the fix due at 11 p.m. Japan time as quickly as possible, and, if that is difficult, consider temporarily stopping the site as one way to reduce the risk. She points readers to the National Cybersecurity Office’s X account. This piece quotes our own translation of the post.

SemiAnalysis, the research firm, on 22 October: it counts 18 Japanese companies that have disclosed breaches since 25 September, lists several of them, summarises JPCERT/CC’s finding that attackers used AI to scan for known vulnerabilities and attack APIs, and quotes the Prime Minister’s PHP post. The 18-companies count in this piece is SemiAnalysis’s; the company figures we use come from the companies’ own notices or reports on them.

Matthew Prince, Cloudflare’s chief executive, posted these figures on X early on 22 October (UTC). Across Cloudflare’s network, he says, there were thousands of attempts to exploit the PHP flaws in the 10 hours before they were publicly announced, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and “millions now”. These are attempts Cloudflare saw, not confirmed break-ins; the timeline table in the Update above is taken from this post.

What JPCERT/CC Found

On 8 October, JPCERT/CC published an alert about leaks of personal information that had been “occurring one after another around September 2026,” in our translation. It listed several kinds of attack, including analysing publicly available smartphone apps “to identify API endpoints and keys.” An API is the doorway an app uses to fetch data from a company’s servers. The alert also says its information “does not indicate that the same attack technique was used in every case.”

A week later, on 15 October, JPCERT/CC published what it found by investigating servers that may have been used in the attacks. In our translation: it “confirmed that the attackers used AI to carry out scans for known vulnerabilities and attacks via APIs.” It adds that such attack servers “were also attacking web services aimed at regions outside Japan.” JPCERT/CC does not say which AI the attackers used, and it does not tie any single company’s breach to AI.

The Breaches Companies Have Disclosed

The research firm SemiAnalysis, in a post on X on 22 October, put the wave in one line: “Since Sept 25, 18 Japanese companies have disclosed breaches, including Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa.” The three largest counts we could check against each company’s own notice, or a report on it, are below. Each company counts in its own unit, so the figures are not one total.

Sourcenext’s notice is the clearest on the route: it says a third party misused “a member-information retrieval API,” in our translation of its wording, and it is asking customers to reset their passwords. Times Car says it will delete all the identity-document images it holds by the end of October.

What Defenders Are Told to Do

JPCERT/CC’s advice is aimed at any company with an app that talks to its own servers. In our translation, it recommends that companies not embed secret keys or long-lived credentials in apps, and that they check requests on the server side rather than relying only on signing or obfuscation inside the app. It also asks for rate limits and monitoring of abnormal requests, “assuming access from outside the official app,” and for limits on where APIs that fetch outside web addresses can reach.

On PHP itself, as our earlier piece reports, Amazon Threat Intelligence “identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure,” and says “PHP2Shell is now being broadly exploited in the wild.” Its advice to security leaders is to “measure patch and mitigation timelines in hours.”

Connecting the Coverage

On 21 October we reported in our PHP flaws piece how Cloudflare saw early attacks as PHP readied its fixes, and later added Amazon’s account of exploitation four days before disclosure. The same day, our Microsoft piece covered Microsoft’s report that the China-state aligned actor Storm-0940 used the ARTEX AI framework to attempt to sign in to more than 2,250 tenants. Our Node.js piece covered the 10 flaws, four rated high, that Node.js fixed on the same day as PHP.

On the defender side, OpenAI said on 21 October that Cloudflare uses OpenAI models accessed through Daybreak to investigate code and assess potential vulnerabilities. What’s new here, as we read it: a head of government asked site owners across a country to prepare to patch that night, and Japan’s national response team says the attackers in its breach wave used AI.

The Structural Read

As we read it, the two threats arrive by different doors: PHP flaws sit in the web server, while JPCERT/CC’s findings point at the APIs behind apps, found by analysing the apps themselves.

As we read it, the disclosed counts show the stakes of the second door: Sourcenext’s notice says a member-information API was misused, and 22,519,960 records may have leaked.

As we read it, JPCERT/CC’s caveats matter as much as its finding: it says its information does not indicate the same technique in every case, and it does not name a company whose breach involved AI.

Three Implications

FOR SITE OWNERS RUNNING PHP The Prime Minister’s post asks owners to “check whether the websites you publish use PHP” and to prepare to apply the fix “as quickly as possible.”

FOR COMPANIES WITH MOBILE APPS JPCERT/CC recommends not embedding secret keys or long-lived credentials in apps, and checking requests on the server side, by our translation of its advice.

FOR SECURITY LEADERS Amazon’s advice, quoted in our earlier piece, is to “measure patch and mitigation timelines in hours.”

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The framework’s starting point: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”

As we read it, Japan shows that layer from the defender’s side: a head of government asking site owners to act, and a national response team asking companies to check who can call their APIs. The framework was published in June 2026 and does not discuss Japan, PHP or JPCERT/CC.

What Is Not Established

JPCERT/CC does not link the PHP flaws to the Japanese breaches, and neither does the Prime Minister’s post. JPCERT/CC does not say which companies’ breaches involved AI, or which AI was used. The count of 18 companies is SemiAnalysis’s; we did not check every name. We could not open Burger King Japan’s own notice, so its figures come from Impress Watch’s report on it.

The Bottom Line

As we read it, two messages met in Japan this month: on 21 October, a national leader asking site owners to prepare to patch that night; and on 15 October, a national response team saying the attackers in its breach wave used AI to scan for known vulnerabilities and attack APIs. By our reading, the two sources stress different defences: the post asks for the fix to be applied quickly, and JPCERT/CC asks companies to check what their apps expose.