Warnings After Series of Unauthorized Access Incidents and PHP Vulnerabilities Domestically and Abroad

In a roundup article, Cybersecurity.com reports that since mid-October 2026 multiple companies and services have reported possible unauthorized access by third parties and potential information leaks. Specific examples include Recruit’s "Car Sensor" with up to 3,709,551 records, Nifty with up to 542,513 records, Furusato Choice with more than 4.45 million records, and Sourcenext with 22,519,960 member records, among cases where estimated affected counts were indicated. These are initial reports based on company notifications, and investigations and verification are ongoing.

In addition, the PHP development team reportedly fixed two critical vulnerabilities on October 21, 2026 that can lead to unauthenticated remote code execution, and IPA and the prime minister have also issued calls for action. Serious vulnerabilities in a widely used programming language can lead to cascading service outages or compromises through unpatched systems, so prompt application of updates in affected environments is required.

The article also lists incidents at organizations of varying industries and sizes such as NEC, PingCAP, Studio, Joshin, and Crypton, noting a range of tactics including compromises via contractors or cloud services, abuse of legitimate accounts, and unauthorized access to management systems. Each company is investigating the scope of impact and whether any data were exfiltrated, and whether the damage will expand will depend on future disclosures.

For readers, the piece suggests that both individuals and organizations should check account information and service notifications they use, apply software patches, enable multi-factor authentication, and take other basic defensive measures. This article is a compilation of multiple individual reports from the same site; for details on each case, refer to the respective individual articles or company disclosures.