Our Response to the PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

On October 20, 2026, the PHP development team announced serious vulnerabilities in PHP (CVE-2026-109618 / CVE-2026-109619). According to reports, these vulnerabilities could allow remote attackers to execute arbitrary code if exploited.

Upon learning of this issue, we immediately began our investigation and have completed all mitigation measures that can be applied at this time. Please see below for the current status of our response.

■ Scope
Web systems built with PHP and WordPress websites that Novalumo Japan G.K. develops and maintains

■ Current Status
The servers we manage directly run a stable release of the PHP 8.3 series. Mitigations available ahead of the official patch, such as configuration changes, have already been applied to the affected environments.

■ Next Steps
The PHP development team has announced that the security patch is scheduled for release at 11:00 PM on Wednesday, October 21, 2026 (JST). Once the patch is available, we will apply it to the affected environments in sequence while verifying that everything continues to work as expected.

At this time, there is no action required from our clients regarding this matter. If you have any questions about how this may affect your systems, please feel free to contact your account representative or our inquiry desk.

This notice is based on the information available at the time of publication. We will update this page as the situation develops.

■ Related Links
PHP: News Archive - 2026
Analysis of the PHP Vulnerabilities (GMO Flatt Security Inc., Japanese)