"Servers with Delayed Security Measures Are Being Targeted Across the Board": Luck CTO Warns Amid Successive Unauthorized Access

A warning about neglected servers

At the KDDI SUMMIT 2026 event on October 28, Rack's CTO, Hiroaki Kuramochi, spoke about cyberattacks in Japan. He said well-protected systems are mostly safe. But servers that people have not checked for security problems are being hit over and over.

Key facts

• Rack says attackers often target systems where security was put off.
• Examples include servers that skipped vulnerability checks, systems without a WAF (a firewall for websites), and systems still using old PHP versions.
• Rack has seen many activities of infostealer malware, which steals login IDs and passwords from employee computers.
• At Rack's security monitoring center JSOC, most serious incidents were first found through suspicious traffic going out of the company network.

How AI changes the game

Attackers have always scanned public servers for weak spots. Now AI and attack tools make this much cheaper, faster, and wider. Finding a weakness and turning it into an attack also takes less time. Monthly maintenance may not be fast enough anymore.

Why this matters

Attackers can steal login details and sign in without using any server bug. Normal outside-only security may miss this. Companies need to watch for strange activity inside their networks too. Kuramochi also says AI does not create entirely new problems. It makes old, ignored weak spots easier to find and attack.

What to watch

• Whether companies move from scheduled updates to faster, ongoing patching.
• Whether more firms add EDR (tools that watch devices for odd behavior) to their servers.
• Whether companies run penetration tests (authorized hacking tests) to see how far an attacker could reach.
• Whether shared virtual server platforms are checked for spread from one hacked system to others.