When explaining to clients, it helps to be able to say "Prime Minister Takaichi said this too": the top-down decision-making seen in the PHP emergency maintenance and vulnerability response in the AI era

The author analyzes the PHP emergency maintenance incident from an engineer's perspective, arguing that Prime Minister Takaichi's rare direct call on X to apply patches as soon as possible made management treat the vulnerability risk as their own matter and shortened the internal decision-making time for companies suspending services. The PHP project released versions fixing two emergency-level vulnerabilities that allow arbitrary code execution from outside without authentication (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, CVE-2026-109618 and CVE-2026-109619, collectively called php2shell); before the fixed versions were published, vulnerability information and a PoC had already leaked and attack attempts were observed, and BASE, pixiv, niconico and others proactively suspended services; the Prime Minister said that temporarily taking a site down is also an effective risk-reduction measure when patching is difficult, and the fixed versions were published about 1 hour after the call.