Japanese banks and airlines suspend services over PHP vulnerabilities

Japanese banks, airlines and transport operators suspended digital services as companies rushed to install emergency security patches for critical vulnerabilities in PHP, a programming language widely used across the internet.

The disruptions spread across Japan on Wednesday and Thursday, affecting online banking, airline applications, airport information systems and commercial websites. Companies temporarily disabled vulnerable services while assessing their exposure to two security flaws that could allow attackers to take control of affected servers.

All Nippon Airways suspended its ANA Pocket smartphone application and the facility for issuing boarding passes through Apple Wallet. The airline said the restrictions were precautionary and did not result from a cyberattack or data breach.

Flight reservations, ticket purchases and online check-in remained operational. Passengers were advised to obtain boarding passes through email, airport kiosks or check-in counters until the affected functions could be restored.

Shizuoka Bank announced a temporary suspension of internet banking services, while Sendai-based 77 Bank restricted selected operations. Mitsubishi UFJ Morgan Stanley Securities halted certain identity verification procedures as financial institutions examined systems potentially exposed to the vulnerabilities.

The Japanese Bankers Association said it had identified no disruption to banking settlement operations, distinguishing interruptions to customer-facing services from problems affecting the country’s underlying payment infrastructure.

Prime Minister Sanae Takaichi urged website operators to apply security updates promptly after their release. She also advised that temporarily suspending website functions could reduce exposure where immediate installation of patches was impracticable.

Japan’s Information-technology Promotion Agency issued an urgent advisory encouraging organisations to identify affected systems and prepare for corrective action. The agency said it had not confirmed attacks exploiting the two vulnerabilities when issuing its warning.

The security weaknesses, identified as CVE-2026-109618 and CVE-2026-109619, were assigned critical severity ratings. Both could potentially permit unauthenticated attackers to execute malicious code remotely, creating risks for websites, databases and connected applications.

PHP developers released security updates on Wednesday, allowing administrators to begin replacing vulnerable installations. The fixes cover supported software branches, including versions 8.2, 8.3, 8.4 and 8.5.

The corrected releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older unsupported versions require additional attention because they no longer receive standard security maintenance from the PHP project.

Security specialists identified memory-management weaknesses involving conditions that could permit malicious requests to compromise server processes. Successful exploitation could expose sensitive information or allow unauthorised operations on vulnerable systems.

The vulnerabilities attracted particular concern because PHP supports numerous commercial applications, content-management platforms and public-service websites. Security authorities warned that internet-facing installations required priority attention, especially where organisations could not immediately establish whether their systems were affected.

Sakura Internet, a major Japanese hosting and cloud-services provider, suspended selected functions while addressing the security risks. Online commerce platform BASE also announced emergency maintenance, saying it had not identified unauthorised access.

Transport operators implemented similar precautions. Keihan Holdings temporarily disabled its website, while Hanshin Electric Railway announced plans for protective restrictions. Keio Corporation prepared to install corrective software, and Tokyu examined potential exposure across its operations.

Disruptions extended to Oita prefecture, where Oita Airport undertook website maintenance beginning Wednesday. Travellers were directed to airline websites for flight information while the airport’s online services were affected.

Oita Bank suspended selected online procedures, including address changes. Usuki city conducted emergency maintenance on a digital shopping-voucher authentication system, temporarily preventing some residents from using the service.

Co-op Oita also experienced interruptions affecting certain electronic-money payments at its stores, illustrating how precautionary measures extended beyond conventional websites into everyday commercial transactions.

The response followed warnings from cybersecurity agencies internationally. The European Union Agency for Cybersecurity, CERT-EU and other European authorities urged organisations to install updates immediately and consider isolating vulnerable systems where patching could not be completed promptly.

Britain’s National Cyber Security Centre issued comparable guidance, advising organisations to identify PHP installations, monitor suspicious activity and consider taking affected systems offline until appropriate protections were implemented.

The Canadian Centre for Cyber Security warned that exposed PHP servers faced heightened risks, while Singapore’s Cyber Security Agency urged administrators to prioritise systems accessible directly from the internet.

Australia’s cybersecurity authorities said they had not identified active exploitation when issuing their initial alert, although researchers subsequently demonstrated techniques capable of exploiting the weaknesses.

Japan’s affected operators said services would resume progressively after patches were installed and the security of individual systems had been checked.