TOKYO - Vulnerabilities were found in the widely used PHP programming language on Wednesday, making the developer race to release emergency patches, according to Japan's government-affiliated Innovation Platform Agency.
The discovered vulnerabilities prompted governments and companies around the world to temporarily shut down websites amid concerns that the loopholes could be exploited in a cyberattack.
Japanese Prime Minister Sanae Takaichi said on her X account that temporarily taking websites off line was an effective measure to prevent abuse if companies were unable to take action immediately.
According to a European research organization, PHP, which is mainly designed for servers, is used by 69.3 percent of websites worldwide whose server-side programming language is known. The developer had announced by the early hours of Wednesday that it discovered two major vulnerabilities. The patches were released to fix the vulnerabilities.
The weaknesses can not only be exploited to steal information but also to destroy systems, experts said.
Following the discovery of the vulnerabilities, the Ministry of Health, Labor and Welfare temporarily suspended a website for its information disclosure system, which lists the contact information and service details of long-term care providers nationwide, as a precautionary measure.
The online store creation service BASE also underwent emergency maintenance, and Tokyo University of Foreign Studies also said that it will conduct an emergency inspection of the web servers it manages.
Sakura Internet Inc. said that it had suspended certain service functions.
Japan's National Cybersecurity Office urged users to take prompt action, including installing patches. "We are closely monitoring the situation," said a government official.
With the impact spreading overseas as well, the European Commission's cybersecurity division has advised organizations unable to promptly apply patches to consider isolating internet-facing applications from public networks.
The National Cyber Security Center in the Netherlands took its website offline, while the British National Cyber Security Center called on organizations in the country to immediately update their systems.
