Japan to set up AI hacker team as PHP flaws knock services offline

Japan plans to create a team of ethical hackers that will use AI to attack the country’s own systems and find vulnerabilities before criminals can exploit them.

The announcement comes as banks, rail operators and government agencies take online services offline to patch two critical flaws in PHP, a programming language used across the web.

Industry Minister Ryosei Akazawa announced the plan on Friday, as Reuters reported. The Information-technology Promotion Agency (IPA), which operates under his ministry, will establish the team in November, Japanese business publication Business+IT reported. It will stage simulated cyberattacks to identify weaknesses that organisations can then fix.

“An attack can succeed by getting through just one hole,” Akazawa said.

“Defenders also need to make use of AI and respond proactively, staying one step ahead,” he added.

Akazawa did not connect the initiative to the PHP vulnerabilities. Instead, he pointed to a rise in cyberattacks on Japanese companies and warned that attackers could use AI to find weaknesses more quickly.

The PHP flaws are already prompting widespread disruption. On October 21, PHP developers released patches for two vulnerabilities that allow attackers to execute code on servers without logging in.

Cloudflare CEO Matthew Prince said attempts to exploit the flaws had reached the millions, according to TNW’s report.

SoftBank suspended emergency alert messages to SoftBank, Y!mobile and LINEMO phones at 06:47 Japan Standard Time on Friday while it works to fix a PHP vulnerability.

Until the service is restored, users will not receive earthquake, tsunami, or evacuation warnings by text. The company expects the work to finish on October 26 and has advised users to install a disaster warning app in the meantime.

Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway also suspended some online services, Reuters reported. Japan’s Finance Ministry, National Tax Agency and Meteorological Agency took services offline as well. Several European government websites were also taken offline on October 21.

Japanese officials have not confirmed any breaches linked to the flaws. Amazon, however, reported an attempt to exploit them on its decoy servers on October 17, four days before the patches were released, The Register reported.

Trend Micro CEO Eva Chen told Reuters that attackers are likely interested in the detailed records held by Japanese companies. AI, she said, also removes language barriers that might once have made those targets harder to pursue.

Alina Maria Stan builds connections that people actually feel. As co-founder and COO of Tekpon, she turns product intuition into real moment (show all) Alina Maria Stan builds connections that people actually feel. As co-founder and COO of Tekpon, she turns product intuition into real moments of discovery, shaping how teams find and adopt SaaS every day.

Since 2020, she has led Tekpon’s brand voice, media strategy, and growth plays with a clear focus on human outcomes behind every metric. Before Tekpon, Alina followed curiosity across industries and countries. She was CEO of King Casino Bonus and led affiliate and brand strategy at Extremoo Media and Fable Media in Denmark, where she learned how to build partnerships that last.

Early on, she sharpened her CRM and pricing instincts at K.H. ApS, always asking why customers choose what they choose. Her approach is rooted in more than a decade of international experience and two master’s degrees, one in Sustainable Consumption from the Technical University of Munich and one in Consumer Affairs Management from Aarhus University.

Get the most important tech news in your inbox each week.

Thanks! Check your inbox to confirm your subscription.

By subscribing you agree to our Privacy Statement.