0
Buying clothes. Booking a haircut. Signing up for a points card.
And not only that.
Hospital appointments. Filings with the city office. Messages from your child's school.
Business deals, bank transfers.
So much of daily life can now be done online.
And each time, your name, address, date of birth, phone number and password are handed over to a server somewhere on the other side of the screen.
Of the websites whose server-side language is known, about 70% run on PHP.
It began in 1995 as a small tool one programmer released to run a personal home page.
There is probably almost no one who has never placed their information on top of PHP.
On October 20, two critical flaws in PHP were announced. Patch release: October 21, 11 p.m. Japan time (14:00 UTC).
The PHP development team rated both 9.2 out of 10. The highest category, "Critical."
Last time, I wrote that machines are searching for doors left unlocked, at speeds no human can match.
This time, the location of those doors is announced to the whole world at once.
Where the flaws are stays secret until the patch is released.
The real danger begins after the patch is out.
Before the patch: Zero-day
Only a handful of people know where the hole is. Attackers are feeling their way in the dark.
After the patch, before it is applied: 1-Day
① The moment the patch is published, a diff of the code before and after the fix begins
② The answer to "where was the hole?" spreads across the world
③ AI quickly assembles attack code and targets every server not yet patched, all at once
The list of targets was made long ago. What used to be weeks of grace is now a matter of hours.
After the patch is applied: The trap after the fix
Bypass attacks that slip through a rushed fix. Configuration mistakes made in haste. Applying the patch is not the end.
And there are places the patch never reaches. More than 30% of PHP sites still run old versions that no longer receive fixes.
This is not just a story for engineers.
What can be taken from a breached site: the names, addresses, email addresses and passwords left there.
If the payment page is rewritten, the card numbers typed into it are stolen too. In Japan, card data has leaked from online stores this way again and again.
On the same day, a major Japanese cloud service announced that malicious programs had been placed on its servers. Up to 26,739 servers may be affected.
The cause is still under investigation, and no link to PHP has been announced.
Users were asked to change the IDs and passwords they had stored on those servers.
A key left out for convenience becomes the way in.
What each of us can do has not changed in years.
Don't reuse the same password. Turn on two-factor authentication. When an email claims to be a "password reset" or a "maintenance notice," don't click the link; check through the official app or website.
Still, today's events are only one part.
The breaches and leaks of recent weeks, and today's patch, are each a separate incident when viewed one by one.
But line up the dots, and a line appears.
A sign that the world is about to change in a big way.
I think this, too, is one form of war.
But it is not one country facing another.
There is no declaration of war, and no front line.
Instead of soldiers, programs work day and night.
What decides the target is not nationality or size, but whether there is a hole.
The booking page of a small shop in town and the core of a large corporation sit on the same list.
And I believe that as this battle deepens, it leads toward the very foundation of the economy.
In Japan, there is about ¥1,640 trillion in money, including deposits.
Of that, only about ¥110 trillion exists as bills and coins.
The remaining 90-plus percent is numbers recorded in the ledgers of financial institutions.
As I wrote last time, money lost its gold backing in 1971 and became something that stands on trust alone.
What supports that trust is the belief that the ledgers are correct.
And what protects the ledgers is a system of keys born fifty years ago.
When the ledgers themselves can no longer be believed, what is money?
If we have called the exchange of numbers "the economy," what was the economy?
A system built on trust shakes, as a whole, when that trust shakes.
The Age of Air moves fast.
What was common sense a month ago may no longer hold.
Pluto, meanwhile, takes 248 years to circle the sky, and stays in Aquarius for about twenty years.
Beneath a surface that shifts quickly, the foundation is being replaced, slowly, from the roots.
At times like this, I think we end up returning to the same question.
What is trust?
In Japanese, the trust that underpins money and the trust between people are written with the same word.
The "credit" in credit card also comes from the Latin word for "to believe."
When we open a card or take out a loan, our credit is kept as a record of payments, and checked.
Trust in the ledger shakes when its keys are broken.
Trust between people is not protected by keys.
It is not the number of promises kept, nor how few lies were told.
It is whether you truly care for the other person.
That lives only inside each of us and is recorded nowhere. Which is why it cannot be pried open from outside.
There is one more thing I noticed while watching these events.
Attacks, scams, and even the words that report them: the way in is always fear.
Opportunistic scam emails rush you: "Change it now, or it's dangerous."
Some posts about this incident, too, stirred fear with numbers no one could verify.
People driven by fear click before they check.
People driven by anger share before they check.
Last time, I wrote about businesses that put anxiety first and make people reach for things they don't need. It is the same mechanism.
That is why not being ruled by fear or anger is not a matter of attitude. It is the surest protection there is.
Seen as dots, each event looks frightening.
Seen as a line, you understand it is part of a larger current.
And once you understand, you can stay calm.
Still, as long as we are human, fear and anger will never disappear.
I think we have come here to watch what happens on this planet, all of it included, as a kind of show.
Last time, I wrote "as one who came to play on the Earth in this age."
To be surprised, to be afraid, to be angry, and still find it fascinating.
All of it is the privilege of those who came to play.
And however much the scenery changes, the last question that remains is the same.
What is a human being?
No matter how the numbers in the ledger are rewritten, we get hungry several times a day and sleepy when night comes.
With a roof that keeps out the rain, we can sleep in peace.
Rice grows in paddies, and fish grow in the sea. They do not grow in ledgers.
The work of touching the soil, going out to sea, and bringing forth food remains, whatever system it stands on.
To eat, to sleep, to have someone beside you.
Family, friends, the people you make things with.
What has truly held people up has always been right there.
What we have called happiness is there too.
At the end of my last piece, I wrote that knowing something unchanging exists somewhere is what puts people at ease.
If we try to keep up through speed, we cannot beat the machines.
But who we share our table with, whom we trust, and what we hold dear as we fall asleep: no machine, however fast, can rewrite these.
Because none of it is written anywhere in the ledger.
Our services and products, both our own and those entrusted to us, are not directly affected by this. Not by chance, but by design. Even so, there is no such thing as absolute security. If new facts come to light, we will report them here.
