2026-10-30
Response Status for Multiple Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
This notice describes Kuroco's response to multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619), known as "PHP2Shell".
Response status
The PHP version used by Kuroco has been upgraded. In addition, our investigation of the logs found no evidence that these vulnerabilities were exploited.
| Date and time (JST) | Details |
|---|---|
| 2026/10/21 22:10 | Applied mitigations, including blocking multipart requests (some features were restricted). |
| 2026/10/22 00:46 | Applied additional mitigations. |
| 2026/10/22 08:32 | Completed the PHP version upgrade. |
| 2026/10/22 08:44 | Lifted the blocking of multipart requests. |
Impact during the response
From 2026/10/21 22:10 to 2026/10/22 08:44, multipart requests were blocked as a mitigation, so some features were restricted. The blocking has now been lifted.
References
- IPA security alert (Japanese)
- JPCERT/CC: Alert regarding multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (Japanese)
Contact
If you have any questions regarding this matter, please contact Kuroco support.
Related documents
Support
If you have any other questions, please contact us or check out Our Slack Community.