PHP Vulnerability Forces 31 Japanese Municipalities Offline

At least 31 municipalities across Japan are still suspending or scaling back their websites while they repair systems affected by a serious vulnerability in the PHP programming language, it emerged on October 30. Small local governments make up most of the group, and the updates needed to patch PHP appear to be taking them longer than expected.

A check of the websites of all 1,741 Japanese municipalities found that, as of 9 p.m. on October 29, eight cities, 17 towns and six villages could not display their normal pages. Visitors saw messages such as "under maintenance" instead.

Few staff with IT expertise

An official in Izena Village, Okinawa Prefecture, said the village is small and has few people with IT know-how, so it is handling the fix with guidance from its contractor. In Toyo Town, Kochi Prefecture, whose site is also unreachable, an official said the system had worked normally until now but had become outdated. Rebuilding the website costs money and takes time, the official added.

On October 21, Prime Minister Sanae Takaichi urged organizations that could not apply the fix quickly to consider taking their sites offline temporarily. According to information on municipal home pages, at least 200 local governments were affected in some way.

Why it matters

Delays are most visible in small municipalities short on IT staff. Because local government sites also carry disaster information, a prolonged shutdown could affect services for residents. Strengthening cybersecurity at the local level has become an urgent task.

The PHP vulnerability has already disrupted well-known Japanese online services, several of which entered emergency maintenance after the project released a fixed version rated "critical." For municipalities, the next step is completing the software updates or site rebuilds that would allow normal pages to return.