PHP Vulnerability Responses by Company

インクレイブ株式会社

Japan-based services
Aliases / services
インクレイブ株式会社 / Incrave / ZIPSERVER
Official website
https://cloud.incrave.co.jp/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Shared hosting

Response status
Remediation complete
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

All servers were patched by 16:00 JST on October 22, including CloudLinux extended-support fixes for older PHP. Unauthorized access remains under separate investigation.

Scope: Shared hosting only. Dedicated-hosting patching and intrusion investigations are separate.

What users should do

No customer action is required for this issue.

Official service URL

Source URLs

  1. Cloud hosting response to PHP2Shellhttps://cloud.incrave.co.jp/news/php2shell/Response evidence
  2. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence

Dedicated hosting / dedicated cloud

Response status
Patching per customer
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October 27 update says patches are being applied per customer environment. Investigation into unauthorized access continues.

Scope: Completed shared-hosting or ivalue work and intrusion audits do not establish completion here.

What users should do

The hosting notice requires no customer action; watch individual notices about temporary downtime.

Official service URL

Source URLs

  1. Cloud hosting response to PHP2Shellhttps://cloud.incrave.co.jp/news/php2shell/Response evidence
  2. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence

ivalue Ver.2

Response status
Remediation complete
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Remediation finished October 23 at 16:00 JST. The October 27 16:30 update reports no established unauthorized access exploiting this issue.

Scope: Separate from the non-applicability finding for Ver.3.

What users should do

Normal use is available; follow any further individual guidance.

Source URLs

  1. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence

ivalue Ver.3

Response status
Outside this vulnerability's scope
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Ver.3, released August 20, 2026, is reported outside the scope of the announced vulnerabilities.

Scope: Separate from Ver.2; the notice does not attribute this finding to PHP non-use.

What users should do

Normal use is available.

Source URLs

  1. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence

ivalue PORTAL

Response status
Remediation complete
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Remediation finished October 23 at 10:00 JST. The October 27 16:30 update reports no established intrusion exploiting this issue.

Scope: Separate from dedicated hosting and mobign.

What users should do

Normal use is available.

Source URLs

  1. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence

ivalue FORM (dedicated forms)

Response status
Remediation complete
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Remediation finished October 23 at 10:00 JST. The October 27 16:30 update reports no established intrusion exploiting this issue.

Scope: Separate from dedicated hosting and mobign.

What users should do

Normal use is available.

Source URLs

  1. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence

ZIPSERVER

Response status
Remediation complete
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Completed October 22 at 16:00 JST. The intrusion investigation finished October 23 at 18:30 with no established exploitation.

Scope: Applies to the postal-code/address conversion service.

What users should do

Normal use is available.

Source URLs

  1. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence
  2. https://www.zipserver.jp/https://www.zipserver.jp/Response evidence

mobign

Response status
Suspended; recovery in progress
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Suspended since October 21 at 21:00 JST; recovery work remains ongoing as of October 27 at 16:30.

Scope: Completion or resumption of other products does not apply to mobign.

What users should do

Watch for resumption notices and individual guidance.

Source URLs

  1. https://incrave.co.jp/archives/news/5919https://incrave.co.jp/archives/news/5919Response evidence
Related official sources
  1. Cloud hosting response to PHP2ShellOfficial notice

Comments