October 2026 · about 20 Japanese companies targeted with the AI attack tool ARTEX
The clues an attack AI reads
from your site,
found first.
Enter a URL. The number appears on the spot.
Source: ITmedia AI+, 21 Oct 2026 (reported by GMO Cybersecurity by Ierae)
- ①ReconnaissanceWorth checking 3
- ②Picking a weaknessWorth checking 2
- ③Getting inAction advised 1 · Worth checking 4
- ④Taking and spreadingAction advised 2 · Worth checking 2
WHY NOW
What happened in Japan recently
From company announcements and news reports. Stages are marked only where the cause was officially announced.
- 2026-10Ymir Link (email delivery service)
Data from 49 systems leaked, 51,628,280 records counted with duplicates. Client companies including JR Central, JR West and JR Kyushu were affected. The company named a library vulnerability as the cause.
② Picking a weakness③ Getting inYmir Link second report, 26 Oct 2026 - 2026-10GMO Internet Group (servers for automated FX trading)
Servers it lent out for automated FX trading were accessed without authorization, and a ransom of US$50 million (about ¥8 billion) was demanded.
Jiji Press, 26 Oct 2026 - 2026-10skyticket (travel booking)
About 14.64 million records leaked; about 4.13 million of them included login password hashes.
@IT, 13 Oct 2026 - 2026-10Yakiniku King (official app members)
Names, phone numbers and email addresses of about 10.78 million app members (over 90% of sign-ups) leaked. The cause is under investigation.
Nikkei, 5 Oct 2026 - 2026-06KDDI (mail system for ISPs)
Up to 14.22 million records from six providers, including BIGLOBE, Nifty and J:COM, may have leaked. A vulnerability in third-party software was exploited.
② Picking a weaknessINTERNET Watch, 23 Jun 2026
HOW IT WORKS
An attack AI works in four stages
PHPFree checks, from outside and in the same order, what an attack AI looks at in each stage.
- ①Reconnaissance
Reads which software and which version.
What we check- — PHP, CMS and server versions on show
- — What the page source gives away
- ②Picking a weakness
Matches those versions against published vulnerabilities.
What we check- — End-of-life PHP
- — Plugins visible from outside
- ③Getting in
Looks for login doors and entrances left open.
What we check- — Public list of admin accounts
- — CDN or WAF in front
- — xmlrpc, CSP, framing protection
- ④Taking and spreading
Moves through sessions and mail toward your customers.
What we check- — HSTS, cookie protection, https
- — SSL certificate expiry
- — Mail SPF and DMARC
REPORT
What the number means arrives in the report
- Findings by stageWhich clue is used at which stage.
- Three things to do firstStarting from what needs action.
- Site mapPages, features and the scope of a move.
PHPFree
We remove the clues themselves
Instead of changing the lock every time, we remove the door. Your website moves to a build that runs without PHP. It looks the same to your customers.
- ①② No versions on showWith no PHP or CMS running, there are no numbers to read.
- ③ No login doorThe admin screen leaves the site, so there is nothing to guess passwords against.
- Changes by LINE messageWe do the updates.
STEPS
The first step is one URL
- 01Enter a URLRight on this page.
- 02See the numberRisky clues and four stages.
- 03Get the reportWith your name, company and email.
- 04Read it in 15 minutesDecide what to fix first.
Questions
- Q. What information do you collect?
- Only what anyone can see: the home page's response and HTML, the SSL certificate, and the SPF and DMARC records in DNS. We never try to log in or break in.
- Q. Can we fix the risks ourselves?
- The to-do list is written so you can pass it straight to your web agency.
If you have no one to ask, PHPFree moves the site to a build that runs without PHP and removes the risk itself. - Q. Can I read it without IT knowledge?
- Each term comes with a one-line explanation. If you need more, a consultation walks you through your company's situation.
Remove the risks before an attack AI finds them.
All it takes is one URL.