Mitsubishi UFJ Bank suspended parts of its internet banking on Wednesday, including online openings for investment trusts, NISA tax-free accounts and iDeCo pension plans, telling customers it was running emergency maintenance as Japanese institutions reacted to newly disclosed flaws in the PHP programming language that underpins millions of websites.
MUFG did not publicly confirm a direct link to PHP, but Kyodo News and domestic outlets reported the halt as a preventive cybersecurity step. A bank spokesperson cited security concerns when asked by trade publications and declined to specify whether the outage traced to the language vulnerability.
A flaw that rippled through finance and transport
The trouble began after researchers flagged critical defects in PHP, one of the world’s most widely deployed server-side languages. Nikkei reported that regional lenders including Shizuoka Bank and Aomori Michinoku Bank stopped smartphone apps or net-banking features, while Mizuho Bank paused appointment booking on its site. Daiwa Securities and Mitsubishi UFJ Morgan Stanley Securities also interrupted web-based account procedures.
Beyond banks, operators from internet host Sakura Internet to e-commerce platform BASE announced maintenance. Keihan Holdings took its corporate site offline, and Hanshin Electric Railway said it would follow. Keio Corp. told reporters it was checking PHP-dependent systems and applying patches.
Settlement rails still moving
The Japanese Bankers Association said on Wednesday that the nationwide online system connecting virtually all domestic financial institutions showed no impact at that point. That distinction mattered to markets: retail-facing web pages could go dark without freezing salary payments or interbank transfers, at least in the first hours of the response.
Still, the breadth of pauses underscored how a single software stack threads through Japan’s daily commerce. Customers trying to open year-end investment accounts or shift pension contributions found error pages instead of confirmations, even as branches remained open for in-person service.
What customers should expect next
Institutions said they would restore services after verifying patches. MUFG’s notice did not give a firm restart time. Cybersecurity agencies worldwide urged rapid updates; in Japan the episode arrived on the heels of separate breaches at broker IwaiCosmo and police-linked app provider Arcadia, sensitizing regulators and the public to digital risk.
For MUFG—the core banking unit of Mitsubishi UFJ Financial Group, Japan’s largest lender—the outage was a reputational test as much as a technical one. The bank has spent years rebuilding trust after governance scandals elsewhere in the group. Wednesday’s selective shutdown suggested compliance teams would rather absorb short-term frustration than risk exploitable code on a channel that handles household savings.
Analysts said the episode was unlikely to move quarterly earnings on its own, but it could accelerate Ministry of Finance and Financial Services Agency scrutiny of third-party software inventories. Until MUFG flips its direct-banking switches back on, the practical advice for account holders was blunt: use a branch, wait, or watch the maintenance banner—because the patch race was still running across the archipelago.