Six Apart
- Aliases / services
- Six Apart / Movable Type / MT / Movable Type Advanced / Movable Type Premium
- Official website
- https://www.sixapart.jp/
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
Movable Type cloud edition
- Response status
- Remediation complete
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
All cloud environments were updated to PHP 8.3.36 at 00:12 JST on October 22, including environments with automatic updates disabled. The October 26 addition says the same maintenance also addressed the separate CVE-2026-115560.
Scope: The Movable Type application version was not changed. Customer-managed PHP for software/AMI editions is handled separately.
What users should do
No customer action is required for this remediation.
Official service URL
Source URLs
- Response to vulnerabilities in PHPhttps://www.sixapart.jp/movabletype/news/2026/10/22-0020.htmlResponse evidence
Movable Type software edition (including Advanced / Premium)
- Response status
- Customer update required
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
The notice requires updating the customer-managed PHP runtime to a patched release.
Scope: Updating Movable Type alone does not replace patching PHP. Cloud-edition completion does not cover this environment.
What users should do
Apply a patched PHP release appropriate for your environment. If hosting is managed by a provider, check that provider's remediation status.
Official service URL
Source URLs
- Response to vulnerabilities in PHPhttps://www.sixapart.jp/movabletype/news/2026/10/22-0020.htmlResponse evidence
Movable Type AMI edition
- Response status
- Customer update required
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
The notice requires updating the customer-managed PHP runtime to a patched release.
Scope: Updating Movable Type alone does not replace patching PHP. Cloud-edition completion does not cover this environment.
What users should do
Apply a patched PHP release appropriate for your environment. If hosting is managed by a provider, check that provider's remediation status.
Official service URL
Source URLs
- Response to vulnerabilities in PHPhttps://www.sixapart.jp/movabletype/news/2026/10/22-0020.htmlResponse evidence
MovableType.net (including Forms and Site Search)
- Response status
- Not affected
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
The official notice explicitly states that these services neither use PHP in their systems nor allow customer PHP execution, and are unaffected by the two target vulnerabilities.
Scope: Covers MovableType.net, Forms and Site Search. These are distinct from Movable Type software and cloud editions.
What users should do
No customer action is required for these PHP vulnerabilities.
Source URLs
- https://www.sixapart.jp/mtnet/announce/2026/10/22-1100.htmlhttps://www.sixapart.jp/mtnet/announce/2026/10/22-1100.htmlResponse evidence
Lekumo Business Blog
- Response status
- Not affected
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
The official notice states that the system does not use PHP or provide customer PHP execution, and is unaffected by both target vulnerabilities.
Scope: This notice covers Lekumo Business Blog only, not every Lekumo product.
What users should do
No customer action is required for these PHP vulnerabilities.
Source URLs
- https://www.sixapart.jp/lekumo/bb/news/2026/10/22-1240.htmlhttps://www.sixapart.jp/lekumo/bb/news/2026/10/22-1240.htmlResponse evidence
Related official sources
- Response to vulnerabilities in PHPOfficial noticeExplicitly covers both CVEs, completion for all cloud environments and actions required from software and AMI edition users.
Comments