0
Public services in Japan, including hospital reservations and disaster prevention information, have been suspended one after another as a precaution against hacking following the discovery of a security vulnerability in PHP, which is used to operate websites. The image combines a map of Japan with digital data to illustrate cybersecurity. / Getty Images Bank

Public services in Japan, including hospital reservations and disaster prevention information, are being suspended one after another. Following the discovery of a critical security vulnerability in PHP, a programming language widely used to operate websites, institutions have temporarily suspended their services to prevent hacking. Although no unauthorized access or data leaks have been confirmed at the institutions that suspended services, the preventive measures are causing growing inconvenience to the public.

According to major Japanese media outlets on Oct. 23, the discovery of a critical flaw in PHP, a programming language widely used for website development, has prompted emergency responses from Japan's central government ministries, local governments and medical institutions. After the government issued a warning on Oct. 21, institutions began temporarily shutting down websites or suspending some of their functions.

PHP processes information on servers in response to user requests. It is used to retrieve product information from online shopping websites and transmit information entered into inquiry forms to businesses. The PHP Foundation said that if the flaw is exploited, attackers could gain unauthorized access to personal information stored by website operators or alter website content.

The Asahi Shimbun reported that the flaw had gone undetected for more than a decade before a U.S. security company discovered it using artificial intelligence (AI). A vulnerability in technology that is available free of charge and widely used across various sectors has thus led to widespread service disruptions.

The disruptions are also affecting Japan's medical sector, interfering with health screening reservations and access to medical service information. Osaka Habikino Medical Center in Osaka Prefecture shut down its website for breast cancer and cervical cancer screening reservations on the night of Oct. 21. The hospital has yet to determine when the service will be restored. Kushiro City General Hospital in Hokkaido also suspended its website, leaving patients unable to access information on medical departments and transportation options through the night of Oct. 22.

		0
An Ethernet cable connected to a computer. / Yonhap News Agency

Electronic book services became unavailable at municipal libraries in Kawaguchi and Kawagoe, Saitama Prefecture. Advance ticket reservations at the 21st Century Museum of Contemporary Art, Kanazawa, were also suspended. The Kanagawa Prefectural Police's driver's license renewal reservation website underwent emergency maintenance beginning at 1 a.m. on Oct. 22 and reopened at 4:10 p.m. the same day.

Information needed for disaster response has also been affected. Tottori Prefecture temporarily suspended its disaster prevention information portal, which provides river water levels and other information. An office worker in Tottori City told the Yomiuri Shimbun, "A typhoon is approaching, and it's troubling that I can't access the information I need." The Japan Meteorological Agency also suspended parts of its website early on Oct. 22, preventing users from accessing temperature and precipitation data. Services were gradually restored starting that evening.

The Ministry of Health, Labour and Welfare suspended 31 systems and websites, including a search system for nursing care service providers and a security training website for medical institutions. The Supreme Court's case law search service and the Imperial Household Agency's application system for tours of the Imperial Palace and other sites were also temporarily suspended. Tetsutaro Uehara, a professor at Ritsumeikan University, told the Yomiuri Shimbun that website operators should immediately take action in accordance with the PHP development team's guidance if they are able to apply the fixes themselves. If they cannot address the problem directly, they should suspend website operations until their server hosting providers take the necessary measures, he explained.

Separately, the Tokyo Metropolitan Police Department held an emergency meeting in Tokyo's Bunkyo Ward on Oct. 22 with approximately 80 security officials from 59 companies operating critical infrastructure in sectors including electricity and finance. In response to a recent series of large-scale personal data breaches, the police asked the companies to encrypt data and delete unnecessary personal information.

South Korea also needs to determine whether the technology is being used domestically and assess the potential impact of the vulnerabilities. In particular, services such as hospital reservations and disaster prevention information, whose suspension directly affects people's daily lives, face the challenge of establishing alternative arrangements, including telephone reservations and other means of providing information, alongside security measures.