Japan plans to use artificial intelligence and simulated attacks to test technology systems, as PHP released fixes for two critical vulnerabilities that can enable remote code execution.
Industry Minister Ryosei Akazawa said Japan would form an ethical hacker team, Jiji Press and Reuters reported. Jiji Press reported the team would be based at the government-affiliated Innovation Platform Agency and help companies, including critical infrastructure operators and small and midsize businesses, strengthen their cyber defenses. The outlet reported a November start.
The PHP security team released fixes Oct. 21 for CVE-2026-109618 and CVE-2026-109619. The flaws can let attackers run code on affected servers without logging in, according to the team’s advisory. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP urged users to update. EconoTimes previously covered the fixes for the two PHP flaws.
Cloudflare cited a W3Techs estimate that PHP is used by almost 70% of websites whose server-side language it can identify. The company also said it saw attack traffic targeting customers while vulnerability details were circulating before public disclosure. SoftBank said it temporarily suspended the front pages of its Y!mobile and LINEMO websites for emergency PHP maintenance. Both were restored at 4:30 a.m. ET (5:30 p.m. JST) Oct. 22.
The discovery process involved AI as well as defensive work. OpenAI said security firm Calif used GPT-5.6 Sol to identify a critical PHP flaw, while the PHP Foundation said Wiz independently reported both vulnerabilities. The Foundation said its review found no working exploit in the proof-of-concept material it examined before the patches shipped.
The PHP Foundation said the cause of the out-of-memory issue had been identified in 2024, while later reports clarified its potential for remote code execution. It called the delay in fixing the issue a structural failure involving security-team decision-making and a lack of resources. In May, Japan’s Ministry of Economy, Trade and Industry (METI) described advanced AI as a tool that can help find vulnerabilities but can also create risks if misused; it also called for faster vulnerability response and stronger safeguards.
