On the critical PHP vulnerabilities: our products do not use PHP and are unaffected

On 21 October 2026 (UTC), the PHP development team published a security update addressing two critical vulnerabilities in PHP. A number of services in Japan have since carried out emergency maintenance.

In short: the products we build and operate do not use PHP at all, and are therefore unaffected.

About the vulnerabilities

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)

Both are rated Critical, the highest of four levels, with a CVSS 4.0 base score of 9.2. They may allow remote code execution without authentication.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every PHP environment that handles web requests is said to be in scope, with PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed named specifically.

How our products are built

LLMOcheki and every other product we build and operate are built on Next.js, and no PHP runtime is involved.

Nor do we use WordPress or any other PHP-based CMS for our services or our corporate site. The corporate site and our service sites are delivered as static sites built with Astro.

There is therefore nothing in our products that needs addressing in response to these PHP vulnerabilities, and we have not carried out any emergency maintenance.

Where we stand on Next.js

Next.js published a security release of its own on 14 October 2026.

We have completed the update to the fixed releases — 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) — across every product running in production. The sharp library used in image optimisation has also been updated to 0.35.5 or later, the threshold given in the published workaround.

Going forward

We monitor vulnerability information for the technologies we depend on, and apply fixed releases promptly once they are published.

As a service entrusted with customer data, we will continue to communicate what is in scope and where we stand, whether or not we are affected.

If you have any questions, please get in touch through our contact form.