SoftBank suspends disaster alerts as PHP security repairs reach critical services

SoftBank has temporarily stopped delivering emergency earthquake, tsunami and disaster evacuation alerts to customers of its Japanese mobile services while it carries out security maintenance. The October 23 notice turns a critical flaw in widely used web software into a disruption of a service people depend on for urgent warnings.

The operator said the suspension covers SoftBank, Y!mobile and LINEMO. Maintenance began at 6:47 a.m. Japan time on October 23, and completion is planned for October 26. In its official notice, the company directs customers to alternative services such as the Yahoo! disaster-alert application during the interruption.

A preventive shutdown is not proof of a breach

SoftBank attributes the work to vulnerabilities in PHP, the software language used to run many websites and online services. Its notice does not establish that attackers compromised the emergency-alert system or stole customer information. The stated event is a maintenance-related suspension; treating it as a confirmed intrusion would go beyond the evidence the operator has provided.

The affected service is the emergency-alert delivery channel identified in the notice. It should not be described as a shutdown of all SoftBank mobile communications, or of every warning mechanism available in Japan. The distinction matters because an exaggerated description could obscure the practical step the company is recommending: using an alternative source of alerts while this channel is unavailable.

This is also separate from SoftBank’s October 22 website maintenance. The company said the Y!mobile and LINEMO official sites resumed at 5:30 p.m. that day. Restoration of those websites does not mean the later emergency-alert maintenance was already complete. Each service has its own status and recovery timetable.

The weakness sits below individual applications

The PHP project released security fixes on October 21 for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow remote code execution without an attacker first logging in. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older unsupported branches require a supported upgrade path, rather than an assumption that they are unaffected.

PHP’s developers say the risk spans web-serving configurations including PHP-FPM and Apache’s mod_php. In the latter configuration, they describe an attack that can trigger before application code runs. That helps explain why checking only a website’s own scripts is insufficient: the vulnerable component can sit underneath the application and process requests before its normal business logic begins.

CERT-EU recommends updating affected installations promptly and considering isolation of exposed applications when a fix cannot yet be applied and verified. It also highlights products that embed PHP internally. An organization may therefore have affected software even when its own development team does not normally write PHP applications.

Security fixes carry an operational bill

For operators, installing a patch is only one part of restoration. They need to locate affected components, establish which vendor package contains the correction, test dependent functions and confirm the service behaves correctly before reconnecting it. That process can create downtime even when the purpose is to prevent an intrusion. It is a resilience problem as well as a software-maintenance task.

Japan is also planning a team that will use AI to simulate cyberattacks and identify weaknesses, Reuters reported Friday. That is a proposed defensive initiative, not evidence that such a team has already repaired the PHP flaws or secured every affected service. AI-assisted testing still needs authorized scope, technical validation and a process for fixing what it finds.

Our coverage of security risks from AI agents and enterprise access controls addresses related governance questions. Here, the immediate measure of recovery is more concrete: confirmation from SoftBank that emergency-alert delivery has resumed. Its October 26 target remains a plan until the operator reports completion. A maintenance deadline is not a substitute for a service-status confirmation, particularly for warnings whose usefulness depends on timely delivery.