Japan will create a government team that uses AI to simulate cyberattacks and expose weaknesses in technology systems, Reuters reported on October 24, as the fallout from critical vulnerabilities in the PHP language widened. The flaws, known as PHP2Shell, have drawn millions of hacking attempts since their disclosure, and government and company websites around the world went offline this week while operators rushed to protect or shut down their systems. On Friday, SoftBank — Japan’s third-largest mobile carrier — said it was suspending its emergency alert system for mobile users as a precaution. The move marks a turn from emergency defense to offense: Japan wants to probe its own systems with the same AI-assisted methods attackers are already using.
What The Simulation Team Is Meant To Do
Japan’s government will set up the team to simulate cyberattacks with AI models and use the results to identify weaknesses in technology systems before real attackers find them. The announcement came as organizations were still scrambling to curtail risks from the PHP flaws, and it signals that Tokyo sees AI-driven testing as a necessary answer to AI-driven attacks.
The logic follows the week’s lesson. Security researchers found PHP2Shell with the help of frontier AI models, and attackers are now using the same class of tools to probe millions of servers. As Aikido Security co-founder Madeline Lawrence put it this week, companies are “racing to update against attackers who can use AI to exploit them. That’s the whole race.” A government red team running AI simulations would give defenders machine-speed reconnaissance of their own infrastructure.
SoftBank Suspension Shows The Scale Of Disruption
SoftBank said on Friday that it was suspending its emergency alert system for mobile users — a striking step from one of the country’s largest carriers, and a measure of how seriously Japan is taking the PHP2Shell threat.
The carrier’s announcement is the latest chapter in a disruption that has swept the globe. The disclosure of the critical vulnerabilities prompted millions of hacking attempts, and sites went offline from Tokyo to Helsinki as operators chose shutdowns over compromise. Japan has been among the hardest hit: as GEroundtable reported in its coverage of the PHP2Shell exploitation wave, brokerage Nomura, lender Mitsubishi UFJ, airline ANA and East Japan Railway all temporarily suspended some internet services, while brewer Asahi, insurer Tokio Marine and several government agencies took websites down.
What Defenders Are Doing Now
The immediate defense remains the same two options: patch or shut down. The PHP Foundation released fixed versions — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — and Japan’s prime minister told businesses to patch or take their sites offline. The US National Security Agency has warned the flaws could let attackers seize control of web servers, steal sensitive data and disrupt services.
Administrators are also being told to look backward, not just forward: Amazon Threat Intelligence detected probing as early as October 17, four days before disclosure, and says PHP2Shell is “now being broadly exploited in the wild.” Server logs should be reviewed back to at least that date.
Why It Matters
Japan’s simulation plan is the first sign that a major government is treating AI-assisted attack as a permanent condition rather than a one-off emergency. Until now, much of the official response to PHP2Shell has been defensive — patches, shutdowns, emergency alerts switched off. A standing AI red team would institutionalize the attacker’s playbook: probing at machine speed, continuously, before someone else does it.
The move is also a notable shift for Japan, which has historically leaned toward soft law and guidelines for AI rather than hard mandates, betting that a light touch keeps its companies competitive. Pairing voluntary rules with aggressive state-run security testing may become the template for how light-touch regimes handle AI-era threats. And as governments formalize how AI systems may be built and deployed — from Europe’s risk-based AI statute to national frameworks elsewhere — state-run AI security programs are entering the same policy conversation.
For the rest of the world, the message is practical: the skill barrier for large-scale exploitation has fallen. When millions of attempts can be generated in hours, defenders need automation that works at the same speed — and Japan has decided that includes simulating the attacks itself.
Background
PHP2Shell refers to two critical unauthenticated remote-code-execution vulnerabilities in the PHP engine, the server-side language that underpins an estimated 70 percent of the web. The flaws — CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS — were found with the help of AI models by Calif working with OpenAI’s models and by Google’s Wiz in its own AI-assisted research, and the PHP Foundation disclosed them on October 20 with fixes for all supported branches. Within hours, hacking attempts surged into the millions, and the incident drew comparisons to Log4Shell, the 2021 Java library flaw that triggered a similar global patching emergency.
Source: The Japan Times
0 Comments