Japan's PM Who Urged PHP Patching Once Wrote a Cybersecurity Book for PHP Institute
Contents
On the night of October 21, 2026, about an hour before the fix for a critical PHP vulnerability (php2shell) was released, Japanese Prime Minister Sanae Takaichi posted on X.
PHP is a programming language widely used on the server side of websites, and php2shell is the nickname for two vulnerabilities that could let an attacker execute arbitrary code remotely.
Calling it “an urgent request we need you to act on tonight,” she asked operators to “prepare to apply the patch as soon as possible” once it was published.
For sites that could not patch right away, she added that “temporarily taking a website offline, for example, is also one effective way to reduce the risk” (ITmedia NEWS, quotes translated from Japanese).
Japanese media called it unusual for a prime minister to address a specific software vulnerability directly on X.
The same prime minister published a cybersecurity book in 2018 with PHP Institute (PHP Kenkyusho), a Japanese publisher.
The prime minister also took her own website offline
She posted shortly before 10 p.m. on the 21st, and the fixed releases came out on schedule around 11 p.m. JST.
That same night, the National Cybersecurity Office in the Cabinet Secretariat (the government body that supports the prime minister’s cabinet) shared the same advice on X.
Takaichi also took her own website offline from the night of the 21st (Nikkei).
On the 22nd at the Prime Minister’s Office, she told reporters “we cut ours off” and asked them back whether their own outlets’ sites were okay.
Takayuki Kobayashi, the LDP’s policy chief, posted on X that he “shut down the website immediately,” and Finance Minister Satsuki Katayama’s website also became unreachable (Jiji Press).
The book from PHP Institute
The book is Saibā kōgeki kara kurashi wo mamore! (roughly “Protect Our Daily Lives from Cyberattacks!”), subtitled “Japan Will Grow Through the Industrialization of Cybersecurity.”
| Item | Details |
|---|---|
| Author | Sanae Takaichi, with illustrations by Ryuji Fujii |
| Release date | December 14, 2018 |
| Format and price | A5 paperback, 1,760 yen including tax |
| ISBN | 978-4-569-84035-2 |
| Topics | Real cases of and countermeasures against cyberattacks in everyday areas such as healthcare, transportation, finance, and smartphones. Includes 70 pages of manga and a glossary |
PHP Institute’s description calls cyberattack countermeasures an investment rather than a burden, and that products and services with stronger security can gain an edge in Japan and abroad.
PHP Institute and the PHP programming language are unrelated beyond the name.
| PHP Institute | PHP programming language | |
|---|---|---|
| Origin | Founded in 1946 by Konosuke Matsushita, founder of Panasonic | Started as “Personal Home Page Tools” in 1995 |
| What the name means | Initials of Peace and Happiness through Prosperity | Now stands for PHP: Hypertext Preprocessor, a recursive acronym whose first P refers to PHP itself |
PHP Institute is about 50 years older (ITmedia NEWS).
The 2018 LDP proposal Takaichi compiled as headquarters chief
In November 2017, Takaichi became head of the Cybersecurity Headquarters newly set up inside the Liberal Democratic Party (LDP).
The headquarters reported directly to the party president under Article 79 of the party rules. It held 12 meetings starting December 5, 2017, and compiled its “First Proposal” on April 24, 2018.
A party proposal is a document asking the government to take a policy direction. It is not a law.
The foreword of the proposal is signed “Sanae Takaichi, Chief, LDP Cybersecurity Headquarters” (LDP, proposal PDF, Japanese).
Its subtitle reads “Toward minimizing risk. Shift the mindset from ‘cost’ to ‘investment.’”
One of its main sections is “Industrialization of ‘Cybersecurity,’” and it makes the same claim as the book description: products and services with stronger security can gain an edge in markets at home and abroad.
Eight months later, a book came out with that phrase in its subtitle.
The proposal covered the 13 critical infrastructure sectors defined by the government (aviation, railways, logistics, healthcare, electricity, gas, water, oil, chemicals, finance, credit, information and communications, and government and administrative services), plus autonomous driving, national security, and quantum computing.
Autonomous driving and national security each got their own chapter alongside the 13 sectors.
According to the proposal, organizing incident cases, current countermeasures, and remaining issues sector by sector in a common format was “a first within the government and ruling party.”
Hearings with ministries and experts were held behind closed doors, limited to the lawmakers themselves, because they involved information that could give hints to attackers.
The cross-sector recommendations include several items that matter to engineers.
| Recommendation | Content |
|---|---|
| Right of cyber counterattack and cyber self-defense | Consider the laws that would provide the legal basis |
| Mandatory security for IoT devices | Require security measures through critical-infrastructure industry laws and safety laws covering IoT devices. Also calls for security by design |
| Vulnerability research and information sharing | Investigating and sharing vulnerabilities could fall under the Unauthorized Computer Access Act or the criminal offense of possessing computer viruses. Consider how the law should address this |
| Talent | Consider a “vulnerability assessor” certification (tentative name), use white-hat hackers in government and critical-infrastructure exercises, and improve pay and conditions for security engineers |
| Cloud certification | Consider a Japanese version of a certification scheme modeled on FedRAMP, the US government’s cloud security authorization program |
| Lawmakers’ security | Establish lawmakers’ information security through legislation. The party should also centrally manage the PCs of lawmakers who handle national security |
| Budget | Against an initial FY2018 budget of 62.1 billion yen, create a “special cybersecurity allocation” in each ministry’s budget requests |
From the proposals to the active cyber defense law
In May 2019 came another proposal centered on creating a “Cybersecurity Agency” to handle related policies in one place. It set 2025 as the target for launching the agency (Nikkei).
Takaichi later wrote on X that the proposal also included legislation for active cyber defense (Sanae Takaichi’s post on X).
It was in Heisei 31 (2019) that I, as chief of the LDP Cybersecurity Headquarters, compiled “legislation to enable active cyber defense” and “the establishment of a Cybersecurity Agency with unified authority and responsibility” into a proposal and delivered it to the Prime Minister’s Office.
(Translated from Japanese.)
Active cyber defense lets Japan deal with servers used for attacks before damage occurs. The government uses communications data, under a legal basis, to detect attack servers.
Where a server is confirmed, the police or the Self-Defense Forces (Japan’s military) can access it and neutralize it when necessary.
Neutralization requires procedures such as prior approval by an independent body (National Cybersecurity Office briefing, Japanese).
The Act on Strengthening Cyber Response Capabilities (the active cyber defense law) and its accompanying law were approved by the Cabinet on February 7, 2025 and enacted on May 16, 2025.
On July 1, 2025, the National Cybersecurity Office, the same office that issued the PHP warning this week, was set up in the Cabinet Secretariat. The post quoted above is from that day.
In the same post she wrote that she was “deeply moved” that the laws were passed in that year’s ordinary Diet session and that “a new command center for cyber countermeasures” now existed.
What was created, however, was an office inside the Cabinet Secretariat, not the “Cybersecurity Agency” the proposal had called for.
AI and Digital Ministers under the Takaichi cabinet
On AI, the prime minister is taking lessons from Takahiro Anno, leader of the party Team Mirai.
In a May 2026 party leaders’ debate, Anno offered to “come as a tutor if needed,” and Takaichi replied, “Yes, please.”
On August 28 at the Prime Minister’s Office, with Anno’s guidance, she tried a demo in which she instructed an AI to estimate the effects of measures against rising prices, and joked that “maybe I no longer need two of my secretaries” (Nikkei).
Her Digital Ministers have been medical doctors two times in a row.
| Hisashi Matsumoto | Toshiharu Furukawa | |
|---|---|---|
| Term | October 2025 to September 2026 | From September 17, 2026 |
| Background | Emergency physician. Professor at Nippon Medical School and a leading figure in Japan’s doctor-helicopter program | Surgeon and attorney. Four terms in the House of Councillors |
| In their own words | ”The mission given to me, as a physician, is above all to advance digital transformation in healthcare” | Says the prime minister told him, “Use your background. This field is the most important, so take it on.” Cited that “there are extremely few people from science backgrounds in the cabinet” as the reason for his appointment |
When Matsumoto left the post in September 2026 to become a special advisor to the prime minister, he said he had “proved that whether you are an engineer, or whether you know digital technology well, doesn’t matter” (Chiba TV).
His successor Furukawa is also in charge of AI strategy, science and technology, and cyber security, among other portfolios (m3.com, ITmedia NEWS, m3.com).
Matsumoto named digitalization of healthcare as his mission, and Furukawa pointed to the shortage of science-trained ministers as the reason he was picked.
No report could be found in which the prime minister herself says she chose them because they are doctors.
Is the prime minister tech-savvy?
Nothing came up about Takaichi building her own PC or making her own website.
She has also said publicly that she is being taught AI by Anno.
No development or engineering work of hers turns up either, but she has been involved in cybersecurity policy for nearly nine years, since becoming headquarters chief in 2017.
Japanese politics also has the “it revolution” story about former Prime Minister Yoshiro Mori around 2000.
He is said to have read “IT revolution” as “it revolution,” pronouncing IT like the English word “it,” and the story appeared in Shukan Post’s collection of his remarks when he retired in 2012 (NEWS Post Seven).
That article does not say when, where, or to whom he said it, though, and no primary source could be found.