A critical security hole in PHP — the programming language that runs an estimated 70% of the world's websites — triggered emergency patching across the travel industry last week. The flaw, dubbed "php2shell," could theoretically let an attacker seize control of a web server without needing a password. Cybersecurity agencies didn't mince words: patch immediately, or take your site down until you can.
Some organisations did exactly that. All Nippon Airways temporarily suspended select website and app services, including Apple Wallet boarding passes — a headache for anyone mid-trip relying on a digital pass. Japan Airlines pulled certain webpages offline, and East Japan Railway halted some services too. Government agencies and destination marketing organisations were also among those scrambling, since PHP quietly powers a huge share of public-facing sites, from booking engines to tourism boards.
The episode is a reminder of how much travel runs on decades-old, unglamorous infrastructure. PHP isn't a shiny new technology — it's the workhorse behind an enormous portion of the web, which is precisely why a single serious vulnerability ripples so widely. When the people who maintain the language flag something this severe, and official cyber agencies tell companies that failing to fix it means going dark, you know the risk is real rather than theoretical.
For travellers, the practical fallout was mostly short-lived inconvenience: a missing boarding pass feature here, an unavailable page there. But the story matters beyond one bad week. Attackers actively look for unpatched servers, and travel brands hold exactly the kind of data — passport details, payment information, itineraries — that makes them attractive targets. The faster an airline or rail operator moves to patch (even at the cost of temporarily disabling features), the better sign that is for your data.
Worth knowing as a passenger: if a digital service like an Apple Wallet boarding pass suddenly isn't available, having a screenshot or printed copy of your booking is a low-effort insurance policy. And if a travel site you rely on goes offline without explanation, a security incident is one plausible reason — official channels and the company's app or social accounts will usually confirm what's happening. This round, the industry's response was swift, and most disruptions were precautionary rather than the result of actual breaches. That's the outcome you want, even if it briefly complicates your airport routine.
