Japan Turns to AI-Assisted Ethical Hackers

A team of ethical hackers plan to simulate AI-driven cyberattacks. Aiming to identify vulnerabilities in technology systems using PHP, the Japan-based ethical hackers will get ahead of actual hackers. 

The announcement comes as businesses globally respond to vital flaws in PHP, a popular programming language that powers websites and online services. 

Cloudflare reports millions of attempts to exploit the weaknesses. Matthew Prince, CEO of the global cloud services company, told Reuters that in the 10 hours before the attack on PHP systems, Cloudflare witnessed thousands of attempts to exploit the network. In fact, that number quickly went up to “tens of thousands” within a span of “45 minutes.” 

It didn’t stop at tens of thousands; Prince said that the attack attempts then had a staggering increase to ‘hundreds of thousands within two hours' and millions later on.”

Meanwhile, Korea JoongAng Daily reported that “Researchers at Israeli cybersecurity firm Dream” identified 25 compromised systems across four countries, including Japan. “What especially concerns security experts is that firewalls, the very devices meant to keep hackers out, became their way in.” 

On October 23, Reuters reported that AI-assisted cybersecurity experts in Japan plan to hack their way into spotting vulnerabilities before threat actors do. The plan has since received further government backing. On October 26, Prime Minister Sanae Takaichi instructed officials to accelerate AI-assisted vulnerability assessments and strengthen cybersecurity monitoring across supply chains.

Some businesses in Japan were already affected by the AI-detected vulnerabilities, including government sites, All Nippon Airways (ANA), financial institutions and railway operator JR East. SoftBank.

A business in the country allegedly suspended its mobile emergency alert system during maintenance to address the weaknesses. This has temporarily disrupted the delivery of earthquake, tsunami, and other emergency warnings.

The Japanese government aims to carry out the special cybersecurity mission to detect and patch vulnerabilities before further compromises occur. 

TechTarget reported that researchers identified the PHP vulnerabilities in August 2026, but the Coordinated Vulnerability Process (CVD) was disrupted in October when details began circulating ahead of the planned release. 

How Japan Plans to Use AI to Get Ahead of Cybercriminals

Japan is preparing to deploy an expert cybersecurity team that will use AI-assisted testing. The Japanese government intends to help businesses uncover weaknesses in their digital systems.

According to Reuters, the plan is designed in a way that boosts Japan’s cybersecurity by simulating cyberattacks. The idea is to locate potential weaknesses before cybercriminals can exploit them. 

The team of ethical hackers will support businesses responsible for maintaining essential services, as well as small and medium-sized enterprises.

Ethical hackers were particularly brought together to think from the perspective of cybercriminals. 

Ryosei Akazawa, Japan's Minister of Economy, Trade and Industry, also stressed the importance of thinking from a cybercriminal's perspective when assessing potential cybersecurity risks. “Defenders also need to make use of AI and respond proactively, staying one step ahead,” he stated. 

Japan’s proposed plan has since been expanded beyond the original strategy. At a ministerial cybersecurity meeting on October 26, Prime Minister Sanae Takaichi called on officials to use the “expertise and personnel” of the Information-technology Promotion Agency (IPA) to “accelerate” simulated attack testing utilising “highly skilled specialists” and “advanced AI.”

Takaichi emphasised the need for locating vulnerabilities before they lead to disruption, stating: “Verifying system vulnerabilities is also essential to preventing damage before it occurs.”

The government is also seeking to improve cyberattack detection across supply chains, including small and medium-sized organisations. 

Takaichi said that the government would “compile a package of emergency measures by around the end of next week”. The operational status of the ethical-hacking teams and technical arrangements have not yet been publicly confirmed.

PHP Vulnerabilities Trigger Global Security Response

Japan’s announcement comes amid a serious cybersecurity issue affecting PHP, an open-source, server-side programming language used as the backbone of many sites. It helps to develop website content, supports web applications, and works with databases.

On October 21, PHP developers announced new cybersecurity updates that address two key weaknesses, recognised as CVE-2026-109618 and CVE-2026-109619. 

The identified flaws allegedly permit remote code execution on any PHP installation serving web requests. These would be flagged as a risk. According to Katie Baker, a journalist at EM360Tech, both CVE-2026-109618 and CVE-2026-109619 flaws are rated 9.3 out of 10. 

The weakness has also been linked to real-world breaches. Korea JoongAng Daily revealed that researchers at Dream found 25 breached systems across four countries, including firewalls. Investigators also discovered evidence signalling possible links to a Chinese hacking group, though their identity remains unconfirmed.

“Fixes arrived on Wednesday in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive official updates,” Baker noted. 

According to the UK National Cyber Security Centre (NCSC), the flaws could let cybercriminals run code off-site on exposed servers, possibly without authorisation.

The disclosure encouraged enterprises to analyse their exposure, introduce new cybersecurity updates, and temporarily stop some services as a precaution.

Affected businesses in Japan included government sites, All Nippon Airways (ANA), financial institutions and railway operator JR East. SoftBank. Another Japanese organisation suspended its mobile emergency alert system during maintenance to address the weaknesses, temporarily disrupting the delivery of earthquake, tsunami, and other emergency warnings.

This case shows how weaknesses in widely used software can shake and severely disrupt services beyond single websites, potentially affecting businesses, public institutions, and vital infrastructure. 

Cloudflare Reports Millions of Exploitation Attempts

Cloudflare has also emphasised the severity of PHP’s current situation. They reported an upsurge in attempts to exploit the weaknesses after their public announcement.

Cloudflare CEO Matthew Prince describes the activity in comments reported by Reuters.

“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Prince said. The number of attempts subsequently rose to “tens of thousands” within “45 minutes”, “Hundreds of thousands within 2 hours” and millions thereafter, according to Prince.

The figures suggest attempted cyberattacks, but they don’t mean these attempts resulted in successful data breaches. However, the sudden increase shows the pressure enterprises face when private, vulnerable data becomes public.

The rise in exploitation attempts has renewed emphasis on how governments can locate and tackle vulnerabilities before they cause widespread disruptions.

While Japan is developing an AI-assisted ethical hacking approach, the UK is also expanding its use of AI to boost cyber defences while responding directly to the PHP security incident.

UK Government Expands AI-Powered Cyber Defences

On October 22, Baroness Lloyd of Effra told the House of Lords that “The Government had acted proactively ahead” of the public disclosure of the PHP vulnerabilities. They worked with the National Cyber Security Centre (NCSC) to identify potentially affected systems and prepare security updates.

According to ITV News, the NCSC also issued “more than 50,000” warnings to businesses and other organisations, underscoring the Government's wider response. However, the incident still disrupted public services, with the Government reporting 32 unavailable services and four “partially unavailable.”

The response follows an expanded effort to use advanced AI for defensive cybersecurity. On October 12, Minister of State (Minister for Artificial Intelligence) Kanishka Narayan announced an extension of a government programme that had helped “find and address 1,352 vulnerabilities across 548 code repositories in 18 participating departments.”

“I want Britain to become one of the hardest countries in the world to attack using artificial intelligence,” Narayan stated.

Lord Pitt-Watson, the Treasury Lords Minister, said £130 million in funding will be used to strengthen cyber defences, allocating “£60 million to the National Cyber Shield” and “£70 million to a new National Exposure and Real-Time Vulnerability Centre.” The aim is to strengthen cyber defences and detect weaknesses across essential infrastructure and the wider economy.

These measures together demonstrate how AI is becoming part of the UK’s approach to identifying system weaknesses before cybercriminals can exploit them. However, the PHP incident also emphasises the need for prompt security updates and rapid incident response, as AI speeds vulnerability detection.

Alongside Japan’s proposed measures to enhance its cybersecurity, the UK’s approach underscores the need to expose and mitigate weaknesses before cybercriminals can compromise systems.

AI: Cybersecurity Hero or Villain?

The new advancements raise a widespread question about AI’s role in cybersecurity: Is the technology becoming a defender’s greatest friend or giving attackers another advantage?

AI-assisted research helps cybersecurity experts examine software and uncover weaknesses that might otherwise go undetected. This can give businesses a chance to report vulnerabilities before attackers exploit them.

According to IBM, “AI-powered risk analysis can produce incident summaries for high-fidelity alerts and automate incident responses, accelerating alert investigations and triage by an average of 55 per cent”. 

While more AI-backed tools are being deployed to prevent cyberattacks, cybercriminals can also exploit them to automate information gathering, locate and identify exposed systems, and intensify attacks.

Japan’s proposed plan underscores AI's cybersecurity benefits, while the rise in PHP exploitation attempts reveals the need to respond quickly when weaknesses are exposed. 

AI is not an automatic answer to cybersecurity risks; its importance varies on how it is built, implemented and used.

What Should Enterprises Do Next?

Enterprises on PHP systems should firstly follow their local government cybersecurity guidelines. They should also identify systems and apply the appropriate security updates as quickly as possible.

The NCSC recommends “prioritising internet-facing systems” and updating to the “latest version of PHP”. If a system cannot be protected fully, enterprises “should consider taking the system offline until it can be fully mitigated.”

Cybersecurity teams should also investigate potential signs of compromise and “continuously monitor for security updates from third-party software vendors” whose systems include PHP.

Japan’s AI-assisted cybersecurity team may offer an alternative approach to locating vulnerabilities before attackers expose them. However, robust security measures depend on enterprises addressing cybersecurity weaknesses, strengthening business security systems and responding quickly to evolving cyber threats.