Critical PHP Vulnerabilities: No Direct Impact on Our In-House Systems; Impact Through External Software We Use Is Under Review
On October 20, 2026, the PHP security team issued advance notice of two critical security vulnerabilities, each rated 9.2 under CVSS v4.0.
On October 21, 2026, PHP announced the release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, addressing these vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Arterect Inc.
Potential impact on our systems
We do not use PHP as a development language in our internally developed systems, including our official website.
However, PHP may be used indirectly through open-source software (OSS), container images, third-party products, development and operations tools, or external components. We therefore plan to assess the potential impact on related environments.
Official website assessment (updated October 21, 2026)
We reviewed the official website’s source code, dependencies and deployment configuration, as well as installed packages, services and web server routing on its live server. No PHP usage was identified within the scope reviewed. The official website therefore does not require a PHP update in response to these vulnerabilities.
These findings cover the official website and its hosting server. We will continue assessing other systems and external services, including information from their providers.
Our response policy
We will proceed with the following actions:
Assess the scope of impact
We will check systems and development and operations environments under our management, including OSS and containers, for potential impact.Continuously gather and evaluate vulnerability information
We will review official PHP security information and information from relevant software vendors to determine the scope of impact and necessary measures.Implement necessary security measures
If an impact is identified, we will take appropriate measures, including security updates, configuration changes, and operational verification.Inform customers and stakeholders
If an impact on customers or stakeholders is identified, we will provide timely information as appropriate and take the necessary action.
Possibility of emergency maintenance
If further investigation or updates to official information indicate an impact on systems under our management, or a need for security measures, we may perform emergency maintenance without prior notice.
Emergency maintenance may temporarily suspend some services or restrict certain functions.
We will make every effort to provide advance notice where possible, minimize disruption, and restore services promptly.
We apologize for any inconvenience this may cause to our customers and stakeholders and appreciate your understanding as we prioritize system security.
Going forward
In developing and operating AI and web systems, we place great importance on the security of the entire software supply chain, including OSS and external components.
We will continue to gather vulnerability information, assess risks appropriately, and strive to provide secure and reliable systems.
Reference