This week, two candidates working in cybersecurity and cloud postponed meetings with me. Both had the same reason: they were working around the clock on customer fixes for the PHP vulnerabilities disclosed on 21 October.

At the same time, anyone subscribed to emails or services from Japanese businesses will have received a steady stream of notices about the vulnerabilities, emergency maintenance and, in some cases, unauthorised access to servers.

The week raised a question I wanted to look into further: what did this episode actually expose, and what does it mean for the years ahead?

What happened

On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers have named PHP2Shell. PHP is the language behind around 70% of websites, including every WordPress and Drupal site. The flaws sit in PHP itself, affect nearly every version released in the past decade, and allow an attacker to run code on a server without logging in. They carry a severity score of 9.2 out of 10.

The flaws were found by researchers at Wiz and Calif, working with OpenAI, using frontier AI models. Calif identified the first issue on 1 August and Wiz on 19 August. Wiz reported to the PHP security team on 24 August, and the fix and public disclosure followed on 21 October.

Attackers moved quickly. Cloudflare recorded tens of thousands of exploit attempts within 45 minutes of the announcement and millions by that evening, and Palo Alto Networks’ initial analysis counted 22.6 million potentially vulnerable instances. Some exploitation appears to have started before the official announcement, which suggests the details leaked early.

Japan’s response was unusually public. Prime Minister Sanae Takaichi urged site operators on X to act that night and said a temporary shutdown was a valid option. ANA, JR West and MUFG suspended pages or services. Hosting providers, including Sakura Internet, published updates on their own response. Valtec, which provides cloud business, booking and point-of-sale systems, announced on 22 October that attackers had exploited a PHP vulnerability and that customer information should be treated as leaked. At least two long-running online games announced they would close permanently, because their decade-old infrastructure could not be patched safely.

How AI changed the picture

The flaws themselves were not new. OpenAI president Greg Brockman noted that the underlying bug had been in PHP for 14 years, and that a limited version was found in 2024 but not judged significant. What changed was the cost of turning it into a working attack.

Wiz describes the episode as an AI inflection point. Its researchers say frontier models helped them chain several bugs together and adapt the exploit to different PHP versions and configurations, so that one researcher completed in a week what would previously have taken a highly skilled team months. Their conclusion is that flaws once considered impractical to exploit are now realistic targets, and that more discoveries of this kind are likely to follow.

The security community is divided on who benefits more. Raluca Ada Popa of Google DeepMind has called frontier AI a game-changer for cyber defence. OpenAI, which helped find the flaws, has warned that the same capabilities can help attackers build exploits quickly. TJ Sayers of the Center for Internet Security makes a similar point, that AI is surfacing long-buried flaws and making complex attack chains practical. Cloudflare reported attackers altering their payloads to get past its emergency firewall rules within hours.

The common thread in what I have read is that the window between a flaw becoming known and being exploited has narrowed sharply, and that it is likely to stay narrow.

What the week exposed

Three issues come up repeatedly in the commentary.

Old systems are the hardest to protect. Patched releases exist for PHP 8.2 and later, and emergency patches were issued for 7.4 to 8.1 because of the severity. Systems older than that, or applications that break when PHP is upgraded, have no simple fix. The two Japanese games that closed said exactly this: their infrastructure was more than a decade old and could not be made safe. The same question applies to any business running a website, booking system or internal tool that was built years ago and has not been actively maintained since.

Knowing whether you are safe is harder than it looks. Hosting providers and Linux distributions can apply fixes without changing the visible version number, so a version check alone may not show whether a server is protected. Wiz also notes that the attack happens below the application layer, so application logs may show little.

The people who maintain core software are under-resourced. Much of the internet runs on open-source projects maintained by small teams. OpenAI has committed funding and tools for under-resourced maintainers, but has acknowledged that this will not reach every project. It has also proposed a new framework for disclosing vulnerabilities, on the basis that AI is changing the timelines current practice was designed around.

Cloudflare’s advice summed up the position for most organisations: its firewall rules were a stopgap, and customers should patch.

What it means for enterprise technology hiring in Japan

Japan was short of security people before this week. The ISC2 workforce study estimated a shortfall of around 110,000 cybersecurity professionals in Japan, and in its 2025 findings 42% of Japanese security professionals said their organisation could not hire the people it needed, against 29% globally.

What I saw this week was that shortage in practice. The people fixing the problem were the same senior engineers, consultants and cloud specialists who are already in demand, working through the night for customers on top of their existing work. If AI keeps narrowing the gap between disclosure and attack, as the researchers above expect, that kind of week becomes more common rather than less.

For the international enterprise technology companies I work with, I would expect this to sharpen demand in a few areas:

  • security engineers and consultants who can respond to incidents and patch at speed, in Japanese
  • application security and vulnerability management specialists who understand legacy estates as well as modern ones
  • cloud and platform engineers who can move older systems onto supported, maintained infrastructure
  • presales and solutions engineers at security vendors, who will be fielding many more conversations with Japanese customers asking what this means for them

The longer-term lesson for employers is about capacity. Organisations that came through this week well had people with the time and authority to act on the night. That is worth planning for before the next one, rather than during it.

Sources