XServer emergency maintenance, and our response to the PHP vulnerabilities

This is a general notice for all clients whose sites we have worked on. It does not mean that a problem has been found with any particular client's site.
The Japanese version is here（日本語版はこちら）

Thank you, as always, for your continued support.

XServer, the hosting service we use, has been carrying out emergency maintenance since 16:00 on Wednesday, October 21, 2026 (JST). Some clients have asked us about it, so here is what we know so far and what we are doing.

XServer's announcement

As a precaution against a security vulnerability in software it uses, XServer has temporarily suspended its official websites and control panels. Its announcement (in Japanese) says the following.

本対応は当社サービスに対する不正アクセスの発生に伴うものではございません。

Translation: This measure is not the result of any unauthorized access to our services.

本メンテナンスによるお客様のご利用サーバーへの影響はございません。
Webサイトの表示やメールソフトでの送受信は、通常どおりご利用いただけます。

Translation: This maintenance does not affect the servers you use. Websites will display, and email can be sent and received in your mail software, as usual.

On the servers themselves, XServer says it will apply official fixes, or its own fixes, to each PHP version it provides once the fixed versions are released.

XServer expects to resume service between late at night on October 21 and the early hours of October 22 (JST).

PHP security releases

On October 21, 2026, the PHP development team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The official PHP website says:

There are no complete mitigations, updating is the only safe choice.

What we are doing

Once we have confirmed that XServer has applied its updates and reopened its control panels, we will check the sites we have worked on, one by one. We will check that each site displays correctly, that its contact form sends, and that nothing has changed unexpectedly.

We expect checking every site to take all of Thursday, October 22. The time needed depends on the number of sites and their condition, so we cannot promise an exact timeframe. Thank you for your understanding.

Some sites may need fixes as a result of the checks. If so, we will explain the details to you individually. Thank you for your understanding.

We will contact each client individually with the results. If anything concerns you in the meantime, please reach us through your usual contact or the contact form.