Security vulnerabilities in the programming language have disrupted booking systems, apps and websites nationwide, leaving organizations scrambling to respond.
(Stock image/Pexels from Pixabay)
A serious system vulnerability found in the PHP programming language continued to cause disruption on October 22, a day after the issue came to light.
With PHP used on roughly 70% of the world's websites, organizations across Japan, including those that offer essential services, have been forced to respond.
Medical Clinics
The Tokyo Shinjuku Respiratory Clinic uses PHP for its online appointment system. In response to the issue, it temporarily shut the system down from the morning of the 22nd as a measure against unauthorized access, and it is now accepting reservations by phone only.
A representative explained, "We only have one phone line, and calls from patients are coming in nonstop." The clinic is short-staffed and has not yet been able to apply the security patch.
At the Odayaka Life Internal Medicine Clinic in Saitama Prefecture, the PHP-based online reservation system went down around 10 PM on the 21st. The company that operates the system is working on a fix, but there is no estimate for when it will be restored.
The clinic's website urges patients who suddenly develop symptoms such as a fever and wish to visit to come in directly without an appointment.
Okusuri Techo Plus, an app for managing medications and medical visit records, has been suspended since the night of the 21st. According to its developer, Nihon Chozai, the app has more than 2.7 million registered users, who are unable to do things such as send prescription images to pharmacies.
University Admissions
Some universities were hit by the problem just as results were being announced. Kyoto Institute of Technology announced the first-round successful applicants for its comprehensive selection process on its website on the 21st.
Following the issue, however, it took most of its website offline. As it was still unable to restore the site on the 22nd, it posted the examinee numbers of successful applicants on X.
A representative said, "We have not received any inquiries by phone from applicants."
Banks and Local Governments
In Hokkaido, Hokkaido Bank temporarily suspended its app, which lets users check balances and handle deposits and withdrawals from their smartphones.
Koshigaya City in Saitama Prefecture temporarily suspended the payment service for an electronic coupon program supporting residents amid rising prices of food and other goods. Namegawa Town in the same prefecture disabled several functions, including the inquiry form and the waste-sorting search tool.
Agriculture
The issue has also affected information sharing in the agriculture industry. The Mikkabi Agricultural Cooperative in Hamamatsu, known for mandarin oranges, uses a system linked to its website to send roughly 2,500 members information such as pest outbreaks and weather updates.
Because the website runs on PHP, it was taken offline from the night of the 21st. A representative expressed concern, saying, "If this drags on, it could cause various problems."
Volunteer Information
The International Horticultural Expo Association, organizer of the International Horticultural Expo 2027 (Flower Expo) opening in Yokohama next March, announced on the 22nd that information on expo volunteers may have been leaked.
The association said the data consists of email addresses and registration numbers assigned to each individual, and does not include names. Approximately 12,000 volunteers are expected to take part.
According to the association, the company that operates the email delivery service used to contact volunteers suffered unauthorized access to its systems, resulting in an information leak. The data may include information on the Flower Expo's volunteers, and the association is currently looking into the matter.
(Read the related article in Japanese.)
Author: The Sankei Shimbun