Japan reports a wave of AI-assisted attacks on firms and agencies
Officials cite data on about 260 million people since April, while leak reports rose from 303 in September to 830 in October.
72
- Mentions · 7d46
- Mentions · 30d161
- All mentions236
- First seenAug 13, 2026
- Last mentioned18h ago
Timeline
236 articles · newest firstSuspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Japan Airlines says Amadeus breach exposed about 92,000 passengers
About 2,000 also had passport numbers and contacts exposed; access ran from August 2023 to September 2026.
74
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
RIZAP employee uploaded 726 health records to a personal AI chat
Japanese mutual-aid members' names, birth dates, insurance numbers and disease categories were sent to an unapproved AI account.
48
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
88
Hackers steal 2.6 million records from Sony ISP So-net
Intruders hit the member database on October 19, taking subscriber data plus about 54,000 email passwords and 16 bank records.
74
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
OffensiveCon Japan agenda covers Chrome, Telegram and iOS research
October 27–28 session titles name Skia, Telegram stickers and Muse Spark, but list no CVEs, versions or confirmed attacks.
28
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
76
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
76
Credit Saison reports 954% ROI from a ChatGPT Enterprise pilot
A 315-person pilot saved 14 hours a month per person, and Credit Saison rolled ChatGPT Enterprise out companywide in September 2025.
22
Japan Airlines says Amadeus breach exposed 92,000 customer records
About 2,000 of those customers also lost passport, frequent-flyer, email and phone data; flights and cards were unaffected.
66
Sony ISP subsidiary breach exposes 2.5 million customer records
So-net and plala files include names and birth dates, plus 54,401 email passwords, with no confirmed misuse.
76
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
86
GMO Internet tells Onamae.com customers to disconnect PCs after breach
As many as 26,739 servers may be affected; GMO refused a ransom of about 8 billion yen and has not found ransomware on devices checked so far.
74
Times Car said to report ¥5.5 billion loss after breach
The linked DataBreaches.net page did not load past a Cloudflare check, so no loss, victim, or data details are available.
28
GMO tells customers to disconnect PCs after breach and ransomware threat
The company said up to 26,739 servers were at risk after malware was found on some customer environments.
73
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
80
Sony So-net breach exposes 2.58 million customer records
Passwords for 54,401 email addresses and 16 bank account records were exposed; membership passwords and cards were not.
74
So-net breach exposes personal data of more than 2.58 million customers
Attackers took membership details plus 54,401 email passwords and 16 bank-account records; membership passwords and card data were not included.
76
GMO Internet warns Desktop Cloud customers after ransomware threat
Attackers demanded about ¥8 billion after unauthorized access; GMO says no ransomware was confirmed by October 27.
74
Hackers use CyberStrikeAI agents against Japanese organizations
TrendAI says 44 agents checked at least 19 organizations in October 2026, with deep compromise only in a small share.
64
Trend Micro: three Japan-focused attacks used AI to different degrees
Only one case was confirmed as agent-driven; entry often used exposed legacy systems and default or reused credentials.
72
AI-assisted intruders target Japanese firms and steal credentials
TrendAI reconstructed three infrastructures; the deepest access used exposed admin panels and stolen or default credentials.
68
Sony confirms So-net and plala breach of 2.58 million records
Contact data, some email passwords and 16 bank-account records were exposed; membership passwords and cards were not.
76
GMO offers $1 million bounty after Desktop Cloud breach
Attackers demanded about $50 million after malware and customer data theft; trading logins were abused at brokers.
74
GMO tells Onamae.com users to shut down PCs after extortion threat
Attackers demanded about ¥8 billion; alleged data appeared online, but GMO has not confirmed ransomware.
74
GMO urges Onamae customers to shut down PCs over ransomware threat
GMO says data was posted after an October 20 intrusion that may have hit 26,739 servers; it refused an ¥8 billion ransom and says encryption did not run.
74
CyberStrikeAI’s 44 agents automated attacks on Japan organizations
Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.
74
GMO says attackers posted data from Onamae desktop breach
The firm shut the trading desktop service on October 21 after a roughly $50 million ransom demand and now advises password resets.
74
Cloudflare Radar records 49 Internet disruptions in Q3 2026
Exam shutdowns in Iraq and power failures, including large drops in Honduras, Cuba, and Sevastopol, led the quarter’s outages.
44
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2015-330699%10.0Arbitrary file read/write via ProFTPD 1.3.5 mod_copy
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2026-1069313%8.5OS command injection in SiteGuard Server Edition
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Appears with
- Microsoftvendor · 39
- CISAorganization · 22
- Microsoftorganization · 20
- Googlevendor · 20
- Microsoft 365product · 18
- Personal Information Protection Commissionorganization · 17
- Palo Alto Networksvendor · 16
- Proofpointorganization · 13
- FBIorganization · 12
- PHPproduct · 11
- Resecurityorganization · 11
- Cloudflareorganization · 10
- Miraimalware · 10
- JPCERT/CCorganization · 10
- National Police Agencyorganization · 10
- CoGUImalware · 10
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.