Global Cyber Crisis Prompts Japan to Turn to AI Defence as PHP Flaws Knock Banks, Airlines and Railways Offline

Japan is turning to artificial intelligence to defend itself against a surge of cyberattacks, after a global security crisis this week forced some of the country's biggest banks, airlines, railways and government agencies to take online services offline.

The government will set up a team to simulate cyberattacks using AI in order to find weaknesses in technology systems, Minister of Economy, Trade and Industry Ryosei Akazawa announced on Friday, October 23, Reuters reported.

"An attack can succeed by getting through just one hole," Akazawa said. "Defenders also need to make use of AI and respond proactively, staying one step ahead."

The announcement came as companies and governments around the world scrambled to respond to critical vulnerabilities in PHP, one of the most widely used programming languages on the internet, which prompted millions of hacking attempts and knocked government and corporate websites offline from Tokyo to Helsinki.

The PHP emergency

PHP powers a large share of the world's websites, from content management systems to e-commerce platforms and corporate portals. This week, researchers disclosed critical flaws that had existed in the language for years. The vulnerabilities were found using AI, and Google's security unit Wiz and OpenAI were among those credited with uncovering them, according to TechCrunch.

PHP's developers released fixes on Wednesday and urged users to "update immediately." But the disclosure set off a race between attackers seeking to exploit unpatched systems and organisations rushing to apply fixes. Many chose to shut down services temporarily rather than risk being breached.

Japan's biggest names go offline

In Japan, the disruption touched almost every part of daily life. SoftBank suspended its emergency alert system for mobile users during PHP-related maintenance, meaning customers would temporarily not receive earthquake, tsunami or evacuation warnings, a significant step in a country highly exposed to natural disasters.

Nomura, Mitsubishi UFJ Financial Group, All Nippon Airways and East Japan Railway temporarily suspended some internet services. JR East said some group services had resumed and others would be restored once confirmed safe. Nippon Paint applied a precautionary security patch, and its website was back online.

Government services were also affected. The Ministry of Finance, the National Tax Agency and the Japan Meteorological Agency suspended some online services, according to Reuters.

A record year of attacks

The PHP crisis arrived on top of what was already Japan's worst year for cyber incidents. More than 500 incidents had been recorded in 2026 by mid-October, exceeding the 473 recorded in all of 2025 and the previous annual record of 503 set in 2024, according to figures reported by Sify. September alone saw 86 incidents, 37% more than July.

On October 8, a ransomware attack hit IDC Frontier, a SoftBank-owned cloud provider, disrupting access to data for 495 client organisations. Days later, Japan's cybersecurity leadership held an emergency meeting, and Cybersecurity Minister Toshiharu Furukawa described conditions as "extremely critical." The National Cybersecurity Office ordered ministries to strengthen defences.

A string of major data breaches followed or preceded the attack. Car-sharing and parking operator Times, part of Park24 Group, said information on 6.6 million members had been affected, including names, addresses, birth dates and driving licence images. JR East and its card unit View Card said up to 6.09 million records may have been accessed, and JR Kyushu reported 1.3 million email records potentially exposed. Daiwa Securities, Tokyo Metro, Lawson, FamilyMart, Rakuten Drive and the Japan Atomic Energy Agency also reported incidents.

Trend Micro logged 13 breaches in Japan in a single day in September, the most in any day this year, according to Briefs. Finance Minister Satsuki Katayama urged financial institutions to reassess their cybersecurity, and the Financial Services Agency warned banks against accepting driving licences as the sole form of identity verification after so many were leaked.

Why Japan is a target

Cybersecurity experts say AI has removed one of Japan's traditional defences: language. Eva Chen, chief executive of Tokyo-based Trend Micro, said attackers are likely targeting Japanese businesses because their detailed records are no longer shielded by language barriers, thanks to AI. She also said Japan had been too comfortable with its existing infrastructure.

AI tools allow attackers to write convincing Japanese-language phishing messages, automate reconnaissance and scan large numbers of systems for vulnerabilities, lowering the cost of attacking smaller organisations. Masaaki Taira, a senior AI policy official in the ruling Liberal Democratic Party, has described the threat as "saturation attacks."

Yoji Watanabe, chief technology officer of Cyber Security Cloud, said attacks were becoming tasks "even amateurs can carry out." Mihoko Matsubara of NTT said the recent wave "seemingly aim at stealing personal information rather than causing disruption," and warned that "some actors could try to identify the threshold of Japanese active cyber defense."

Active cyber defence and AI

Japan activated its Active Cyber Defence framework on October 1, under legislation passed in May 2025. The framework allows authorities, with approval and oversight, to access and neutralise servers used in serious attacks, and introduces mandatory incident reporting for operators of critical infrastructure. It represents a significant shift for a country whose post-war constitution and privacy protections had long constrained offensive cyber operations.

The new AI simulation team builds on this approach. By using AI to attack its own systems, a practice known as red-teaming, the government aims to find and fix weaknesses before criminals or state-backed hackers exploit them. Officials have previously said they plan to keep humans involved in final decisions made by automated defence systems.

The global context underscores the urgency. Microsoft said this week that China-linked hackers used AI agents to target about 2,250 organisations after breaching IT firm ConnectWise, attempting nearly 3,000 sign-ins a minute. Check Point reported an average of 2,803 cyber incidents per week worldwide in September, according to Briefs, up 48% from a year earlier.

The AI arms race in cybersecurity

The PHP episode illustrates both sides of AI's impact on security. The flaws were discovered with AI tools, demonstrating how AI can help defenders find long-hidden weaknesses. But the same capabilities help attackers find and exploit vulnerabilities faster than organisations can patch them.

That dynamic is pushing governments and companies to adopt AI for defence: monitoring networks for anomalies, prioritising alerts, automating responses and continuously testing systems. Security vendors, including Trend Micro, are building AI agents designed to investigate and contain threats at machine speed.

What it means for India

The crisis carries clear lessons for India, which is digitising government services, payments and commerce at enormous scale. Indian banks have faced data exposures this month, including a suspected leak of State Bank of India customer records, and Indian certificate authority eMudhra exited the global website certificate business after a security flaw. CERT-In has urged organisations to patch systems promptly and strengthen defences against supply chain attacks.

Indian IT services companies, which manage systems for clients worldwide, are also on the front line. As AI makes attacks faster and cheaper, they will need to embed AI-driven security into the services they provide. Japan's decision to use AI to attack its own systems offers a model that Indian regulators and companies could adapt.

What comes next

Japan's immediate priority is restoring suspended services and ensuring critical systems are patched. The AI simulation team's structure, budget and timeline are expected to be set out in coming weeks.

For the rest of the world, the message from Tokyo is clear. In an era when AI can find a single weak point in minutes, defenders cannot rely on human speed alone.