AI-Detected PHP Flaws Knock Sega, ANA, and MUFG Offline, Sparking Warnings Across Asia
Two newly discovered vulnerabilities in PHP, the programming language running on roughly 70% of websites with an identifiable server-side language, forced Sega, All Nippon Airways, and MUFG Bank to suspend parts of their online services this week, as governments across Asia urged companies to patch immediately.
A person typing on a laptop surrounded by multiple screens displaying lines of code in a dark room · Source: Getty Images
Two serious vulnerabilities uncovered in PHP, one of the internet's most widely used programming languages, disrupted online services at some of Japan's best-known companies this week, prompting authorities across Asia to push for urgent security updates. The flaws were identified with the help of AI-assisted security tooling, underscoring how both the discovery and the defense of modern web infrastructure increasingly run through automated systems rather than manual review alone.
Why a PHP flaw travels so far, so fast
PHP's reach is what makes any flaw in it a regional event rather than a niche technical story. The language powers roughly 70% of websites whose server-side programming language can be identified, a dominance built up over two decades of use in everything from small business sites to the back-end systems of major corporations. A critical vulnerability at that scale does not stay contained to a single company or sector; it becomes a race against time for every organization running affected PHP versions, which is effectively a large share of the web.
Household names forced offline
By Thursday, the disruption had reached deep into corporate Japan. Gaming company Sega, airline All Nippon Airways, and MUFG Bank all suspended their websites or parts of their online services as a precaution, a response that speaks to how seriously each organization treated the exposure rather than simply patching quietly in the background. Taking down airline booking systems or banking portals, even briefly, carries real operational and reputational cost, which makes the decision to do so a strong signal of how urgent the threat was judged to be.
Governments push for immediate patching
Authorities across the region responded with calls for companies to apply security updates without delay, treating the vulnerabilities as the kind of flaw that attackers could weaponize quickly once details became public. That urgency reflects a familiar pattern in web security: the period right after a serious vulnerability is disclosed is often the most dangerous window, since defenders and attackers are racing on the same information at the same time.
AI's growing role on both sides of the fight
The fact that these flaws were surfaced through AI-assisted detection fits a broader shift already underway in cybersecurity, where automated tools scan far more code, far faster, than human researchers alone ever could. That is good news when it means critical bugs get caught before attackers find them first, but it also raises the stakes: the same kind of tooling that helps defenders discover flaws early can, in other hands, be turned toward finding and exploiting them just as quickly.
What comes next for exposed businesses
For companies across Asia running PHP-based systems, the immediate task is straightforward even if the scale is daunting: identify every exposed system, apply the relevant patches, and confirm services are safe before fully restoring them. The longer-term question is whether this episode pushes more organizations to invest in the kind of continuous, AI-assisted scanning that caught these flaws in the first place, rather than relying on the slower cycle of periodic manual audits that has defined web security for most of PHP's history.
The SoftBank founder told an audience in Tokyo that building the world's AI infrastructure will swallow 5 trillion dollars a year by 2040, and he brushed aside warnings of a bubble as absurd.
A wave of young, digitally minded hobbyists in China has turned cheap desktop 3D printers into a mass market gadget, powering a boom that has handed a cluster of Shenzhen firms about 90 percent of global sales.
After Llama 4 landed with a thud, Mark Zuckerberg rebuilt Meta's AI effort around Scale AI cofounder Alexandr Wang, a deal that has since produced a new Chief AI Officer, a reported $130 billion-plus spending plan, and a string of Muse app releases aimed at catching up to rivals.
Blockchain analytics firm Chainalysis finds that autonomous AI agents conducted 138 million payments on the Coinbase-incubated Base network by the third quarter of 2026, up from roughly 1,500 a year earlier, with most purchases costing less than a dime and happening within minutes of a bot receiving funds.
Anthropic chief executive Dario Amodei has called for the pace of AI development to slow given the safety risks involved. China's answer, in practice, was to launch 16 new AI models in a single month, with DeepSeek and Xiaomi among the companies racing to ship, underscoring how differently Washington and Beijing are weighing speed against caution.
