many thanks
We have been providing services to you for a long time. Regarding the PHP vulnerability "php2shell" (CVE-2026-109618, CVE-2026-109619), we have received multiple inquiries regarding the affected issues. We would like to inform you about our response status and the current situation.
About apps that need to be supported
Currently, our applications utilize PHP 8.5 for the following apps:
- simple subscriber
- CSV Download
- Easy freee data integration
- Easy custom product options
*PHP is not used in StoreCRM or any related systems.
As of Japan time on October 21, 2026 21:00, we blocked the Multipart POST using WAF and took emergency measures.
As of 2026/10/22 4:30 JST, the patch for PHP8.5.12 / PHP 8.3.36 has been completed and has been applied.
Regarding updates to applications within the same environment
We are implementing the following measures for the server clusters that we are outsourcing to our company.
- As of 10:00 Japan time on October 22, the PHP version in all public environments has been patched (PHP8.5.12 / PHP 8.3.36) I have confirmed that it is
Regarding future actions
If the support for php2shell improves and additional patches are released, we will respond accordingly.
In addition, we will also sequentially address the security issues of node.js that have been mentioned in some reports.
Above
English 
Japanese