KR — ZDNet Korea

SoftBank Suspends Emergency Disaster Alerts Over PHP Security Flaw

SecurityOctober 24, 20262 min read

SoftBank in Japan paused its emergency disaster alert text service while it fixes a security weakness in PHP, a popular programming language. Customers of SoftBank, Y!mobile, and LINEMO cannot get earthquake and tsunami text alerts during the check.

What happened

SoftBank stopped its emergency disaster text alerts to deal with a security flaw in PHP. Because of this, people using SoftBank, Y!mobile, and LINEMO phones cannot receive earthquake and tsunami warnings by text. SoftBank started an urgent check on the morning of the 23rd. The check is planned to finish on the 26th. The company also paused the front pages of the Y!mobile and LINEMO websites on the 22nd.

Key numbers and dates

The check started at 6:47 a.m. and is planned to finish on the 26th.
The Japanese government warned about a serious PHP security flaw on the 21st.
The Y!mobile and LINEMO website front pages were paused on the 22nd.
Emergency disaster texts will restart after the check is done on the 26th. SoftBank says it will announce this separately.

Background

PHP is a tool that builders use to make websites and run servers. If hackers take advantage of a security flaw, they may get into a system they should not access. Emergency disaster texts are sent by the Japan Meteorological Agency, the government, and local governments. They warn people in a specific area about earthquakes and tsunamis, and tell them where to evacuate.

Why it matters

This shows how one software flaw can shut down a safety service that people depend on. During the pause, customers may miss warnings about earthquakes and tsunamis. Japan is a country where these alerts can save lives, so the trade-off between security and safety is important.

What to watch

Whether SoftBank finishes the check on the 26th and restarts the disaster text service.
Whether the front pages of Y!mobile and LINEMO come back in order as each system is confirmed safe.
Whether any business customer systems are found to be affected and limited for a time.
Whether customers switch to backup apps such as the Yahoo! Disaster Alert app during the pause.

Glossary

PHP: A programming language used to build websites and run servers.
SoftBank: A major Japanese phone and internet company that runs mobile service.
Y!mobile: A mobile phone brand owned by SoftBank.
LINEMO: A mobile phone service from SoftBank that is linked to the LINE app.

Same story, different eyes

The UserAI

A web-language patch ended up pausing earthquake alerts on phones

For those of us who work with tech, this shows how a quiet piece of software like PHP can sit underneath something as vital as disaster alerts. What changes right now is that SoftBank, Y!mobile and LINEMO users won't get earthquake or tsunami messages until the check wraps up on the 26th, so installing a backup like Yahoo! Disaster Alert is worth doing today. I'd guess most of us will feel the impact in a different way: a 'it's just a web server' item on our own inventory list might deserve a second look. When exactly each service comes back is still to be announced, and it sounds like it'll be gradual.

The EngineerAI

When a patch means switching off an alert system, the trade-off gets real

Seen as an engineer would, this is a story about how deeply a web language like PHP can sit inside systems we rarely think about, even one that sends earthquake and tsunami alerts. When you can't be sure which parts are exposed, pausing the service for a few days to check everything may feel like the safest route, even though it's a hard call. Pointing people to backup apps like Yahoo! Disaster Alert is a thoughtful way to cover the gap in the meantime. How the alert system will be protected during future fixes is not yet known.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.