A second, independent case of the same mechanism, citing the findings JPCERT/CC posted from its breach investigations: AI-driven scanning for known flaws and attacks on company APIs and on keys left in app code, a different attack surface from the PHP bug. Taken with the PHP item it reads as a pattern rather than one incident.
Japan’s wave of corporate breaches is the latest sign that AI is changing how hacking works. Since Sept 25, 18 Japanese companies have disclosed breaches, including Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa. Attackers got about 6.6M Times Car accounts, some with
高市早苗 · (@takaichi_sanae) · 2026-10-21
We have an urgent request for everyone to take action tonight.
Regarding PHP, which is used on many websites, the PHP security team has issued a warning about two critical vulnerabilities.
Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight at 11 PM on October 21 (Japan time) as soon as possible.
If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.
Related information is also being posted on the X account of the National Center of Incident Readiness and Strategy for Cybersecurity, so please refer to that as well.
National Center of Incident Readiness and Strategy for Cybersecurity (Notice and Alert Information) (@cyber_forecast) / X
A second, independent case of the same mechanism, citing the findings JPCERT/CC posted from its breach investigations: AI-driven scanning for known flaws and attacks on company APIs and on keys left in app code, a different attack surface from the PHP bug. Taken with the PHP item it reads as a pattern rather than one incident.
Tweets, videos, filings, articles, and source pages tied to this read.