Skip to main content
Trending
Ai infrastructureDefense procurementCorporate restructuringAutonomous vehiclesEnterprise aiConsole securityDinosaur evolutionAgentic commerceClinical trialsCorporate mergersHealthcare cybersecurityNuclear deterrencePrisoner exchangesProtein designSakharov prizeTargeted oncologyVaccine safetyAbortion rightsAgent monitoringCar-t therapyDefense techEv transitionGlacier dynamicsHardware bansIndustry layoffsRussia-iran relationsSatellite operationsSino-korean relationsSovereign debtTyphoon champi

full timeline

Global PHP security vulnerability

LiveFactlen Newsroom· Updated

Follow Global PHP security vulnerability in the Factlen app and get an alert when there is news. Get the app

Illustration: Japan is establishing a dedicated task force to proactively probe its own critical infrastructure for vulnerabilities.From: Japan Establishes AI Defensive Task Force as Global PHP Flaws Disrupt Services

Share this story

Latest

By 12:50 UTC on October 24, GMO Internet Group requested the Japanese government to deploy its newly enacted active cyber defense powers after hackers breached its automated foreign exchange trading servers. The attackers compromised up to 26,739 virtual servers on the company's Onamae.com Desktop Cloud service, demanding a ransom and threatening to manipulate accounts across more than 70 securities and foreign exchange firms.

GMO refused the ransom demand and asked state agencies to trace and neutralize the attackers' infrastructure. If invoked, the request would mark the first use of Japan's active cyber defense measures, which took effect on October 1 and allow police and the Self-Defense Forces to pre-emptively infiltrate and disable malicious servers. GMO pledged to compensate affected users and cover realized losses from unauthorized trades.

The breach occurred amid a broader wave of cyber threats, including millions of exploitation attempts targeting the newly disclosed PHP vulnerabilities that have left web infrastructure exposed globally.

How the story developed

Hackers began exploiting a critical remote code execution vulnerability in the PHP programming language on October 17, four days before official security updates were available. Amazon Web Services detected the early exploitation attempts using its MadPot honeypot network. The vulnerability, dubbed PHP2Shell, allows attackers to bypass authentication and install persistent web shells on affected servers.

The flaws affect PHP versions dating back to 5.4.0, threatening over a decade of legacy web infrastructure. By October 21, CERT-EU advised organizations to take vulnerable websites offline if they could not apply the emergency patch immediately. The Dutch parliament and national cybersecurity center preemptively disconnected their sites to prevent compromise.

The PHP vulnerabilities triggered widespread service suspensions across Japan's financial and transport sectors.From: Japan Establishes AI Defensive Task Force as Global PHP Flaws Disrupt Services ·

Following the release of the patches, network defenders shifted from patching to active threat hunting to find attackers who breached systems during the zero-day window. Security researchers noted that patching alone will not remove established backdoors.

The vulnerabilities caused severe digital disruption globally. In Japan, financial institutions, airlines, and government ministries temporarily suspended online services to apply emergency patches. SoftBank halted its mobile emergency alert system, cutting off early warnings for earthquakes and tsunamis during maintenance.

How the PHP2Shell vulnerability bypasses authentication to deploy a persistent web shell.From: Hackers Exploited Critical PHP Vulnerabilities Days Before Global Patches Were Released ·

In response to the disruptions, the Japanese government announced on October 23 that it is establishing an AI defensive task force of ethical hackers to autonomously attack its own critical infrastructure.

What to watch

  • Japan will launch a dedicated AI defensive task force in November to proactively hack its own critical infrastructure.
  • The Japanese government faces a pending request to invoke its active cyber defense powers to trace and neutralize the hackers who breached GMO Internet Group.

Where things stand

  1. GMO Internet Appeals for Active Cyber Defense After Hack Amid Escalating PHP Exploits

    Key point: GMO Internet has asked the Japanese government to use its new active cyber defense powers to neutralize hackers who breached its trading servers, amid a wider surge in PHP-related cyberattacks.

    GMO Internet Group has urgently requested the Japanese government to deploy its newly enacted "active cyber defense" powers after hackers breached its automated foreign exchange trading servers. The attackers compromised up to 26,739 virtual servers on the company's Onamae.com Desktop Cloud service, demanding a ransom and threatening to manipulate accounts across more than 70 securities and FX firms. GMO refused the ransom and asked state agencies to trace and neutralize the attackers' infrastructure.

    If invoked, the request would mark the first use of Japan's active cyber defense measures, which took effect on October 1 and allow police and the Self-Defense Forces to pre-emptively infiltrate and disable malicious servers. The appeal comes as Japan faces a broader wave of cyber threats, including millions of exploitation attempts targeting the newly disclosed "PHP2SHELL" vulnerabilities that have left web infrastructure exposed globally. GMO has pledged to compensate affected users and cover realized losses from unauthorized trades.

    Sources:

Charts, maps and images

PHP powers approximately 77 percent of all websites with known backend architectures.From: Hackers Exploited Critical PHP Vulnerabilities Days Before Global Patches Were Released ·
PHP remains the dominant server-side language, amplifying the impact of core vulnerabilities.From: Emergency PHP Security Flaw Prompts Global Agencies to Order Websites Offline ·
Illustration: SoftBank was forced to temporarily suspend its mobile emergency alert system to apply critical security patches.From: Japan Establishes AI Defensive Task Force as Global PHP Flaws Disrupt Services ·
The Ministry of Economy, Trade and Industry has warned roughly 1,000 organizations to secure their systems.From: Japan Establishes AI Defensive Task Force as Global PHP Flaws Disrupt Services ·
Illustration: Security teams are shifting from patching to active threat hunting to identify servers compromised during the zero-day window.From: Hackers Exploited Critical PHP Vulnerabilities Days Before Global Patches Were Released ·
Illustration: Security agencies advised administrators to isolate internet-facing applications until the patch could be applied.From: Emergency PHP Security Flaw Prompts Global Agencies to Order Websites Offline ·
Show 1 more
The Dutch parliament was among the first government bodies to take its website offline as a precaution.From: Emergency PHP Security Flaw Prompts Global Agencies to Order Websites Offline ·

Timeline

October 2026

  1. GMO Internet Appeals for Active Cyber Defense After Hack Amid Escalating PHP Exploits
    1. GMO Internet Appeals for Active Cyber Defense After Hack Amid Escalating PHP ExploitsKey point: GMO Internet has asked the Japanese government to use its new active cyber defense powers to neutralize hackers who breached its trading servers, amid a wider surge in PHP-related cyberattacks.
  2. Japan Establishes AI Defensive Task Force as Global PHP Flaws Disrupt Services
  3. Hackers Exploited Critical PHP Vulnerabilities Days Before Global Patches Were Released
  4. Emergency PHP Security Flaw Prompts Global Agencies to Order Websites Offline