How AI Accelerated Japan's Cyber Crisis, and How Leaders Should Respond

The week AI found critical flaws in the language behind most websites

On the night of October 21, 2026, the PHP development team released emergency patches for two critical flaws in the core of PHP, the programming language behind roughly 70 percent of websites, including WordPress and Drupal. The flaws, known together as PHP2Shell, carry a severity score of 9.2 out of 10. They can let an attacker run code on an affected server without logging in, and potentially take control of it, even when the website's own code is secure.

Japan felt the shock within hours. The Yomiuri Shimbun reported that banks suspended online services and that Prime Minister Sanae Takaichi's official website was taken offline as a precaution. According to Toyo Keizai, 85 of Japan's 95 regional banks paused at least part of their online services while they checked their systems. The Information-technology Promotion Agency, Japan (IPA) told organizations that could not patch quickly to consider blocking outside access or suspending the service.

The most important detail is who found the flaws. According to OpenAI, the security firm Calif identified a critical flaw using OpenAI's GPT-5.6 Sol model as part of OpenAI's "Patch the Planet" program, while Wiz Research independently discovered and reported both vulnerabilities. OpenAI's Codex Security team is also credited in the disclosure. AI found a long-standing weakness in the foundation of the web. Because defenders found it first, the PHP team could prepare fixes before public release.

That is the good news. The same month showed the bad news. On the same day, Microsoft reported that a China-state aligned group had used an AI agent framework to attack hundreds of organizations, in some cases reaching privileged cloud access in less than three hours. A week later, Synology warned that threat actors were encrypting network storage devices through a flaw it had patched almost two years earlier.

Together, these events point to the central fact for Japanese executives. AI has sped up cybersecurity in both directions. It finds weaknesses faster, it attacks faster, and it leaves organizations that patch slowly more exposed than ever. This article looks at the October incidents, the wider wave of breaches behind them, the reforms Japan has started, and how leaders should treat security in the AI age.

The wider wave behind October's headlines

PHP2Shell arrived on top of a crisis that had been building for two years.

Between April 1 and October 16, 2026, data breaches and unauthorized system access across Japan exposed a cumulative total of approximately 260 million personal records, according to figures compiled by Japan's Personal Information Protection Commission (PPC) and reported by The Yomiuri Shimbun on October 30, 2026. The total counts some people more than once and includes non-resident accounts. Even so, it is more than double Japan's population of approximately 124 million, as estimated by the Statistics Bureau of Japan.

Ransomware remains near record levels. Japan's National Police Agency (NPA) confirmed 226 ransomware cases in 2025, just below the 2022 peak of 230. The 123 cases confirmed in the first half of 2026 set a half-year record. According to NPA survey data, more than half of the affected organizations needed over a month to restore normal operations, and recovery often cost more than 10 million yen per incident.

In our view, one reason these numbers keep rising is the way many organizations have treated Information Technology (IT) security: as a back-office maintenance cost rather than a business risk. Habits of precedent-first decision-making (*zenrei-shugi*) and reluctance to admit weakness (*mubyu-shugi*) can make it easier to keep an old system running than to approve its replacement. The IPA's PHP2Shell alert shows what that costs: PHP 8.1 and earlier versions no longer receive fixes, so organizations still running them have no patch to apply.

How AI is accelerating the problem in both directions

AI did not create Japan's security problems. It has changed their speed. Leaders need to understand both sides.

The good side: defenders can find flaws first

The PHP2Shell disclosure is the clearest example so far of AI working for defenders at internet scale.

• AI tools examined the PHP core and found a path to remote code execution in memory-handling code that had gone unfixed.
• OpenAI's "Patch the Planet" program, run with security partners, is designed to help volunteer open-source maintainers check AI findings, remove false alarms, and prepare fixes before public announcement.
• On October 21, OpenAI published a proposed five-stage process for handling vulnerabilities that AI discovers. It covers confirming and fixing the flaw, giving affected organizations advance notice, working with governments to protect critical systems, preparing product updates, and helping users apply fixes after release. Japan's AI Safety Institute (J-AISI) summarized the proposal for Japanese readers the next day.
• The United States National Security Agency (NSA) issued its own advisory the same day, which gave Japanese security teams an early, authoritative signal to act.

Without AI, these flaws might have stayed hidden until an attacker found them first. With AI, defenders gained a head start.

The bad side: attackers move at machine speed

The same capability is available to attackers, and the October evidence shows they are using it.

• Microsoft reported on October 21 that Storm-0940, a China-state aligned actor, used an agentic AI penetration testing framework called ARTEX from as early as September 2026 to target hundreds of organizations worldwide. In multiple cases, the time from first targeting to privileged access was less than three hours. Microsoft also linked the group to a supply chain compromise of a ConnectWise multi-tenant application.
• Microsoft noted that AI agents work around the clock, on weekends, and on holidays, and can try several attack paths at once. Japanese organizations that rely on business-hours monitoring are especially exposed to this pattern.
• Generative AI has also removed the Japanese language barrier that once filtered out foreign phishing. Attackers can now write natural business Japanese (*keigo*) and impersonate domestic suppliers at almost no cost.
• The IPA ranked "Cyber Risks Surrounding the Use of AI" third among organizational threats in its "10 Major Security Threats 2026" report, published January 29, 2026. It was the category's first appearance on the list.

The gap that matters most: patch speed

The Synology case shows where both sides meet. On October 29, 2026, Synology announced that attackers were exploiting a vulnerability it had fixed in December 2024 to encrypt data on devices running outdated versions of its DiskStation Manager (DSM) software and demand ransom. The company urged users to update immediately and turn on automatic updates.

No new AI discovery was needed for that attack. The fix had existed for almost two years. Many small offices and branch sites in Japan use network storage devices like these for shared files and backups, often with no dedicated IT staff to update them.

This is how AI acceleration hurts organizations in practice. AI shortens the time to find a flaw and the time to exploit it. It does nothing to shorten the time an organization takes to apply the fix. When disclosure and attack both happen at machine speed, an organization that patches in months is exposed for the whole gap.

Why Japan is especially exposed

Three structural features of the Japanese economy make this acceleration more dangerous.

Deep supply chains and small contractors

Large Japanese manufacturers and retailers depend on many layers of subcontractors, and many of these smaller partners lack dedicated security staff. According to the NPA, Small and Medium-Sized Enterprises (SMEs) made up roughly 60 percent of ransomware victims. The IPA ranked "Attacks Targeting Supply Chains and Contractors" second in its 2026 threat list, behind ransomware. The Storm-0940 campaign shows how attackers can use a trusted vendor's access to reach many downstream customers at once.

Legacy technology and double extortion

Many organizations still run aging on-premise servers and remote-access equipment that was installed quickly during the shift to remote work. According to the NPA's report for 2024, double extortion, where attackers both encrypt systems and threaten to publish stolen files, accounted for 82.8 percent of confirmed ransom-demand cases in Japan.

Precautionary shutdowns at national scale

The PHP2Shell response showed how much a single software flaw can disrupt daily life. Banks, local governments, and public bodies paused services while they checked their systems, following the IPA's advice to block access or suspend services where a fast fix was not possible. The shutdowns protected customers. They also raise a question every board should ask: how quickly could we confirm which of our systems are affected?

How past incidents reshaped corporate Japan

October's events landed on boards that had already seen what a major incident looks like.

In June 2024, a ransomware attack hit a dedicated file server at Dwango, a Kadokawa Corporation subsidiary. According to Kadokawa's July 3, 2024 report, the attack suspended the Niconico video service and exposed internal information about Dwango business partners, employees, and some students. Separate servers holding Kadokawa customer and author data showed no evidence of compromise at that time.

In late September 2025, Asahi Group Holdings suffered a ransomware attack on its domestic servers. According to Asahi Group's disclosures, it had to suspend order processing, shipping, and call center operations across its domestic group companies, including its six beer breweries in Japan. Staff processed orders by hand using paper and fax while systems were restored.

When a household beverage brand cannot ship beer because of a server breach, security stops being a topic for the IT department. It becomes a board responsibility tied to revenue and shareholder trust.

The constructive side: reforms the crisis has accelerated

The damage has been real, but the crisis has also broken decades of inertia. Reforms that security specialists had requested for years are now moving.

From passive defense to Active Cyber Defense

In May 2025, the National Diet passed the Act on Prevention of Harm Caused by Unauthorized Acts against Critical Computers (Act No. 42 of 2025), commonly called the Active Cyber Defense (ACD) law. Under the National Cybersecurity Office (NCO), October 1, 2026 marked the entry into force of common security standards for critical infrastructure, alongside the launch of public-private collaboration through the new statutory public-private council established under the Act.

Under the new framework, specified essential infrastructure service providers in sectors such as finance, energy, railways, aviation, and telecommunications must report incidents and accept closer oversight of critical computer systems. The government can now share threat intelligence formally and has legal authority to disable attacker command-and-control servers during severe threats.

Board budgets and legacy retirement

Watching peers shut down factories and pause banking services has unlocked modernization budgets. Chief Information Security Officers (CISOs) who once struggled for funding now have board support to retire unsupported servers, replace vulnerable Virtual Private Network (VPN) equipment, and move scattered on-premise systems to managed cloud platforms.

Standardized supply chain accountability

In March 2026, the Ministry of Economy, Trade and Industry (METI) published its policy for a Supply Chain Security (SCS) evaluation system with clear security tiers for business partners. Instead of sending vendors inconsistent, custom questionnaires, Japanese companies can move toward shared standards that help SMEs improve step by step.

How to treat cybersecurity in the AI age

AI has changed the speed of security. Leaders should respond by changing how quickly their organizations can see, decide, and act. Five principles follow from October's events.

Know what you run before the next disclosure

The IPA's PHP2Shell guidance asks organizations to confirm which versions they run, check whether those versions still receive fixes, and judge whether each system is still needed. That work is much faster if it is done before an alert. Every company should keep a live inventory of its software, including the components inside vendor products and websites, and know who owns each system.

• Keep a Software Bill of Materials (SBOM), a list of the software components inside each system, for public-facing services.
• Set a target time to apply critical patches, measured in days rather than months.
• Decide in advance which services can be taken offline, who approves that decision, and how customers will be told.
• Replace software that no longer receives security fixes, such as PHP 8.1 and earlier, rather than waiting for the next alert.

Use AI for defense, with human review

Attackers already use AI to find weaknesses. Defenders should use the same tools on their own code and systems first. AI code-review and vulnerability-scanning tools can find flaws that human reviewers miss, but their findings still need human experts to confirm them, rule out false alarms, and decide on fixes. The Patch the Planet model, where AI finds issues and humans validate and coordinate them, is a useful template for enterprise security teams.

Govern internal AI through secure environments, not blanket bans

When breaches make headlines, many risk-averse executives ban generative AI. In practice, bans push employees to personal accounts and phones, a behavior known as "Shadow AI," and the company loses visibility over its data.

A better approach is to provide approved enterprise AI environments with contracts that guarantee company data will not be used to train outside models. When AI assistants connect to internal documents through Retrieval-Augmented Generation (RAG), access controls must ensure that an assistant cannot show payroll or merger files to an employee who is not allowed to see them.

Treat AI agents like human colleagues with limited authority

No company gives a new employee administrator access to every system on day one. AI agents deserve the same discipline, and the Storm-0940 case shows how much damage a trusted application with broad permissions can do.

1. Allow AI agents to act alone only on low-risk, reversible internal tasks, such as drafting summaries or sorting support tickets.
2. Require human-in-the-loop approval before any AI agent changes customer records, moves money, or sends data outside the company.
3. Keep tamper-proof logs of every query and action an AI agent performs.
4. Review the permissions granted to third-party applications and vendor integrations regularly, and remove access that is no longer needed.

Execute Zero Trust basics without exception

The Synology case is a reminder that many successful attacks still use known, fixable weaknesses. Advanced AI tools cannot protect an organization that leaves basic gaps open. Leadership teams should confirm these foundations at headquarters and every subsidiary:

• Phishing-resistant Multi-Factor Authentication (MFA) on all remote access, cloud consoles, and administrator accounts.
• Continuous Endpoint Detection and Response (EDR) monitoring, watched outside business hours, so suspicious activity is isolated before attackers can encrypt systems.
• Offline backups kept separate from the main network, with restore tests on a regular schedule.
• Automatic updates for internet-facing devices such as network storage, routers, and VPN equipment, and no direct internet exposure for management screens.
• Training that teaches staff to confirm payment changes and credential requests through a separate channel, because AI-written messages no longer contain obvious mistakes.

Turning acceleration into an advantage

October 2026 showed both sides of AI in a single month. AI models helped find flaws in the foundation of the web before attackers did, while an AI agent helped a state-aligned group break into cloud systems in under three hours. Meanwhile, a fix that had existed for almost two years still failed to protect devices that were never updated.

For Japanese companies, the lesson is practical. The organizations that benefit from AI's speed will be the ones that can match it: they know what software they run, they patch in days, they use AI to check their own systems, and they give AI agents only the authority they need. Those foundations also make it safer to adopt AI across the rest of the business.

References

1. PHP2Shell disclosure site (Wiz Research, OpenAI Codex Security, and Calif), "PHP2Shell: AI uncovers critical vulnerabilities in the backbone of the web," October 2026. https://www.php2shell.com/
2. OpenAI, "Patch the Planet: global response coordination as agents uncover critical vulnerabilities," October 21, 2026. https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
3. Japan AI Safety Institute (J-AISI), "AI News Digest: October 22, 2026" (summary of the OpenAI and NSA PHP announcements). https://aisi.go.jp/activity/activity_news/261023/
4. Information-technology Promotion Agency, Japan (IPA), "Countermeasures for PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619: PHP2Shell)," October 22, 2026. https://www.ipa.go.jp/security/security-alert/2026/alert20261022.html
5. The Yomiuri Shimbun, "Serious vulnerability found in PHP: banks suspend online services, Prime Minister Takaichi's website also paused for countermeasures," October 22, 2026. https://www.yomiuri.co.jp/national/20261022-GYT1T00138/
6. Toyo Keizai Online, "PHP turmoil: 85 of 95 regional banks suspend some services," October 26, 2026. https://toyokeizai.net/articles/-/962444
7. Microsoft Security, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise," October 21, 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
8. Synology Inc., "Synology urges users to update DSM following ransomware attacks on outdated DSM versions," October 29, 2026. https://www.synology.com/en-global/company/news/article/C3RB3R
9. The Yomiuri Shimbun / The Japan News, "Cumulative Total of 260 Million People's Personal Info Leaked in Japan Data Breaches Since April," October 30, 2026. https://japannews.yomiuri.co.jp/society/general-news/20261030-356515/
10. National Police Agency (NPA), "Status of Cyber Threats in Reiwa 7 (2025)," Cyber Affairs Bureau. https://www.npa.go.jp/publications/statistics/cybersecurity/data/R7/R07_cyber_jousei.pdf
11. National Police Agency (NPA), "Status of Cyber Threats in Reiwa 6 (2024)," Cyber Affairs Bureau (source of the 82.8 percent double-extortion figure). https://www.npa.go.jp/publications/statistics/cybersecurity/data/R6/R06_cyber_jousei.pdf
12. National Police Agency (NPA), Cybersecurity statistics index, including the first-half 2026 report. https://www.npa.go.jp/publications/statistics/cybersecurity/index.html
13. Information-technology Promotion Agency, Japan (IPA), "Information Security 10 Major Threats 2026," January 29, 2026. https://www.ipa.go.jp/security/10threats/10threats2026.html
14. National Cybersecurity Office, Cabinet Secretariat, "Cybersecurity Strategy (Provisional Translation)," December 2025. https://www.cyber.go.jp/pdf/policy/kihon-s/cs_strategy2025_english.pdf
15. National Cybersecurity Office, Cabinet Secretariat, English homepage. https://www.cyber.go.jp/eng/index.html
16. Ministry of Economy, Trade and Industry (METI), "Security Countermeasure Evaluation System for Building Resilient Supply Chains," March 27, 2026. https://www.meti.go.jp/press/2025/03/20260327001/20260327001.html
17. Statistics Bureau of Japan, Ministry of Internal Affairs and Communications, "Population Estimates." https://www.stat.go.jp/english/data/jinsui/index.html
18. Asahi Group Holdings, Ltd., "Update on System Failure Caused by Cyberattack," October 8, 2025. https://www.asahigroup-holdings.com/en/newsroom/detail/20251008-0201.html
19. Kadokawa Corporation, "Notice and Apology Regarding Information Leakage Caused by Cyberattack," July 3, 2024. https://group.kadokawa.co.jp/information/media-download/1347/f4a4b93c03cb933c/