Solution Sales & Evangelist on Voice, AI and Digital Solutions. Spent 3 years in London, UK. Long time Gooner and tennis fan. Also check @mazzy0108_photo .
Tokyo, Japan 東京都港区
Joined April 2011
- Tweets121K
- Following7.5K
- Followers6.8K
- Likes258K
Pinned Tweet
The biggest "task", no, I must say the "excitement" of the day. Tune into Zoomtopia 2026. We've already had a great lesson on "mission criticle" from the captain of the NASA Artemis mission go on stage. It's about survival, when you're going to die and making quick decisions. Very real. 👏 – at Minato-ku, Tokyo
The countdown is on. Zoomtopia 2026 launches in two hours... Clear your schedule and get ready to tune in → zm.me/4aV37DO
Aoki Masaru retweeted
National Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language
Calif researchers first found this flaw using OpenAI’s GPT-5.6 Sol
In Europe, Asia and on other continents, authorities have taken a number of government websites offline for the time being to protect them from newly identified security vulnerabilities in a programming language that powers the vast majority of websites online.
The NSA told organizations to patch 2 critical PHP flaws, dubbed PHP2Shell, or pull unpatched servers offline.
Both bugs live in PHP’s core, so every installation serving web requests is at risk, whatever site runs on top.
When a request exhausts memory or hits a fatal error, PHP can leave half-built or freed memory that cleanup code or later requests trust.
On Apache’s mod_php, a demonstrated exploit triggers the corruption before any application code runs, so logins and app-level checks cannot block it.
Cloudflare saw attacks before PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21.
VirusTotal counts about 5.1M IP addresses running PHP, and about 758K that show a version run end-of-life branches with no patched release.
That long tail will set how long PHP2Shell stays exploitable, since each owner must upgrade, find a backport or take the server offline.
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch.
Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.”
> PHP rushed out fixes as it could let attackers without accounts take over web servers.
> Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4.
> When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack.
> Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack.
> Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months.
> A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.
Aoki Masaru retweeted
Japan’s wave of corporate breaches is the latest sign that AI is changing how hacking works.
Since Sept 25, 18 Japanese companies have disclosed breaches, including Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa. Attackers got about 6.6M Times Car accounts, some with driver’s license images. Burger King Japan says 11.18M app member records were affected, and Sourcenext says up to 22.5M records may be out.
Last week, JPCERT/CC, the country’s national computer emergency response team, posted its findings from the investigations into these breaches. The attackers used AI to scan for known vulnerabilities and to attack companies’ APIs. Often they did this by pulling apart a company’s Android app to find the endpoints and any keys left in the code. It is also no surprise that Japanese companies are particularly vulnerable. Japan is still catching up on basic digitization, with many offices still using fax machines to this day!
Now even the PM is getting involved, urging anyone running a PHP website to patch two critical vulnerabilities immediately, or temporarily take the site offline if they can't.
xitter.cf/takaichi_sanae/status/…
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
Aoki Masaru retweeted
そもそも高市さんは科学技術、経済安全保障の閣僚と法案の経験が多く、私の周辺の官僚も「技術が好きすぎる」と評価しているのもあり、本人と周辺が相当セキュリティに理解があった特殊例な気はします。
(経済安保大臣時代に私の本を献本した時、本人名で手書きの返事が返ってきたりしました)
Aoki Masaru retweeted
総理大臣がサイバーセキュリティの重大案件を公式アカウントでツイートするのは異例（というか初？）だと思いますが、これは多分世界的にも珍しく、本人か周辺のこの分野に対する感度が結構高いのだと思います。
4月前半にサイバー能力が高く、インフラや金融を脅かす可能性のあるMythosが発表された時点では、研究開発者がどれだけ騒いでもあまり世間的には話題にならなかったのですが、片山大臣が触れた後にようやく世間的に話題になり、5月に高市総理が触れたあとは急激にスムーズに進みました。１ヶ月かかったというのは早い/遅い両方の意見がありましたが（私はメディアで、首相が技術問題に触れること自体が異例で、評価されるべきとは言ってました）、とにかく効果は非常に高いです。
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
Aoki Masaru retweeted
今回のPHPの脆弱性対応のため、現在もウェブサイトを一時停止されている事業者などの皆様もいらっしゃると思います。
昨日は、高市早苗公式サイトも、すぐに事務所からサイト管理者、サーバー管理者に連絡をしてアクセスができない状態にした上、対応を行ってきましたが、先ほど措置が終了し、アクセスを再開できるようになりました。
状況によっては、サイトを一時的に停止することも重要だと私自身も改めて感じた次第です。
企業を含めサイトを開設されている方々の中には、深夜の対応が必要な場合など、今回のような注意・警戒情報にすぐには気付かない方もいらっしゃると思います。
そうした場合、個社の中でサイト管理を担当されている方、あるいは委託を受けているサイト管理者やサーバー管理者の方が気付くことで、早急に対応に着手することができると思います。
政府では、
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
のアカウントで、重要な注意・警戒情報の発信を行っています。
サイト管理者やサーバー管理者の皆様が、このアカウントを広くフォローして下さることが迅速な対応に繋がるのではないかと、今回の対応を通じて感じました。
Reminder from Prime Minister Takaichi on PHP. If you have a website or web based system, it needs confirmation on whether further actions are required or not at the least. – at Minato-ku, Tokyo
今回のPHPの脆弱性対応のため、現在もウェブサイトを一時停止されている事業者などの皆様もいらっしゃると思います。
昨日は、高市早苗公式サイトも、すぐに事務所からサイト管理者、サーバー管理者に連絡をしてアクセスができない状態にした上、対応を行ってきましたが、先ほど措置が終了し、アクセスを再開できるようになりました。
状況によっては、サイトを一時的に停止することも重要だと私自身も改めて感じた次第です。
企業を含めサイトを開設されている方々の中には、深夜の対応が必要な場合など、今回のような注意・警戒情報にすぐには気付かない方もいらっしゃると思います。
そうした場合、個社の中でサイト管理を担当されている方、あるいは委託を受けているサイト管理者やサーバー管理者の方が気付くことで、早急に対応に着手することができると思います。
政府では、
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
のアカウントで、重要な注意・警戒情報の発信を行っています。
サイト管理者やサーバー管理者の皆様が、このアカウントを広くフォローして下さることが迅速な対応に繋がるのではないかと、今回の対応を通じて感じました。
Well, the Keynote Session of Zoomtopia 2026 was simply full of surprises. Captain of NASA Artemis Mission talking about "mission critical" meaning life and death, "Unified Context Layer" with MCP and Headless, a choir to wrap it up in the end. We need to learn the lyrics and be able to sing it out loud by ourselves toward our customers. That was awesome from @Zoom . 😀👏 – at Minato-ku, Tokyo
Aoki Masaru retweeted
Your meeting ended. Your context shouldn't. ✨
Decisions, action items, and customer history shouldn't vanish when the call does. At Zoomtopia 2026, we introduced the Unified Context Layer, connecting conversations, documents, and data so you always have the full picture.
🔍 Find answers across Zoom and 40+ apps with Agentic Search
📝 Turn meeting notes into follow-up actions with My Notes
🤖 Give AI agents the context to produce structured deliverables
Read the full blog here → zm.me/UnifiedContextLayer
MCP and Headless. That's what we wanted to hear from @Zoom . We've heard it from Salesforce and that's huge but hearing it from Zoom is also huge. That's what I've just heard on Zoomtopia 2026 a couple of minutes ago. – at Minato-ku, Tokyo
Your meeting ended. Your context shouldn't. ✨
Decisions, action items, and customer history shouldn't vanish when the call does. At Zoomtopia 2026, we introduced the Unified Context Layer, connecting conversations, documents, and data so you always have the full picture.
🔍 Find answers across Zoom and 40+ apps with Agentic Search
📝 Turn meeting notes into follow-up actions with My Notes
🤖 Give AI agents the context to produce structured deliverables
Read the full blog here → zm.me/UnifiedContextLayer
I've just noticed one thing. "Likes" are back to where we used to have them. I'm on Android. Hope this is the fixed UI, @grok . To be honest, I want it this way. I've had difficulties checking and posting. 😅 – at Minato-ku, Tokyo
Something has gone wrong with the UI. Is it just me? I can't see the posts I "liked". The whole section is gone. I'm on Android. Do you know why, @grok ?
Aoki Masaru retweeted
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Press-Rel…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Aoki Masaru retweeted
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
Aoki Masaru retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Aoki Masaru retweeted
Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond cnbc.com/2026/10/22/php-goog…
Aoki Masaru retweeted
AI uncovers massive flaw in web's foundational code axios.com/2026/10/21/php-ope…
Aoki Masaru retweeted
International governments and agencies have urged websites to address two critical cyber-security flaws in a programming language which powers much of the internet. Full story: bbc.in/4eqXf6R
Aoki Masaru retweeted
Prime Minister Takaichi directly posted on X about the PHP security flaw on 21:55 JST urging immediate action. I've found a couple of websites unavailable undergoing maintenance and upgrade. – at Minato-ku, Tokyo
Aoki Masaru retweeted
OpenAI has played the big part in discovering the critical security flaws in PHP and it's what Prime Minister Takaichi posted on X directly on 21:55 JST, possibly the very first time we're seeing a political leader in Japan posting or saying out loud about technical issues. – at Minato-ku, Tokyo
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
Reminder on PHP. I've noticed some of the Japanese webpages I often go to are back online after a planned outage. – at Minato-ku, Tokyo