PHP Vulnerability Responses by Company

XServer Inc.

Japan-based services
Aliases / services
エックスサーバー / Xserver / Xサーバー / Star8 / ネットオウル / Netowl / スターサーバー / スタードメイン / StarServer / エックスサーバー株式会社 / XServer Inc. / スターレンタルサーバー / SSLボックス
Official website
https://www.xserver.co.jp/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Xserver / XServer Business / XServer for WordPress

Response status
PHP5.1–8.5 patching completed
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

By October26 06:20, all targeted managed-hosting servers on PHP5.1–8.5 were patched. PHP5.1–8.1 retains version numbers; PHP8.2–8.5 uses fixed releases within each branch.

What users should do

The notice says an urgent branch change is unnecessary for this incident. Check your environment and subsequent provider instructions.

Official service URL

Source URLs

  1. Customer-server PHP security measures, October26https://www.xserver.ne.jp/news_detail.php?view_id=19756Response evidence
  2. https://www.xserver.ne.jp/support/news.phphttps://www.xserver.ne.jp/support/news.phpService and operation documentation

XServer VPS / VPS Business Plan / VPS Cloud

Response status
Customer update required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The provider does not patch PHP inside customer VPS instances.

What users should do

Check the OS and PHP installation and apply patched packages yourself.

Official service URL

Source URLs

  1. Customer-server PHP security measures, October26https://www.xserver.ne.jp/news_detail.php?view_id=19756Response evidence
  2. https://www.xserver.ne.jp/support/news.phphttps://www.xserver.ne.jp/support/news.phpService and operation documentation

Legacy StarServer

Response status
Not listed
Response information checked
2026-10-27

Current re-audit: Official sources searched; no response found · Research date: 2026-10-27

A PHP upgrade notice exists for legacy StarServer; incident-specific patch confirmation is not listed.

Scope: Separate from the completed fixes for new StarRental and StarDomain free hosting.

What users should do

Identify the contract and server, then ask legacy StarServer support about these fixes.

Official service URL

Source URLs

  1. https://www.star.ne.jp/news/detail.php?view_id=14451https://www.star.ne.jp/news/detail.php?view_id=14451Service and operation documentation
  2. https://www.star.ne.jp/news/detail.php?view_id=14462https://www.star.ne.jp/news/detail.php?view_id=14462Service and operation documentation
  3. https://www.star.ne.jp/news/https://www.star.ne.jp/news/Service and operation documentation
  4. Star8: Support and PHP settings 2https://www.netowl.jp/news_detail.php?view_id=3610Service and operation documentation

スターレンタルサーバー

Response status
PHP patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

PHP 7.2–8.5 was patched by October 22, 14:00 JST. Some control-panel functions remain under separate maintenance.

Scope: The notice covers Star Rental Server and Star Domain free servers, not every legacy Star Server plan.

What users should do

No immediate PHP switch is required for this issue. Follow subsequent individual notices.

Official service URL

Source URLs

  1. https://www.star.ne.jp/news/detail.php?view_id=14462https://www.star.ne.jp/news/detail.php?view_id=14462Response evidence
  2. https://www.star.ne.jp/news/detail.php?view_id=14460https://www.star.ne.jp/news/detail.php?view_id=14460Response evidence

SSLボックス

Response status
Partially reopened; maintenance continues
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The website, account, ordering and payments reopened after preventive PHP-related maintenance. Some management functions remain under maintenance.

Scope: This covers SSL Box service interfaces; it does not establish certificate or customer PHP remediation.

What users should do

Check current notices for the function you use. Separately check PHP on servers using the certificate.

Official service URL

Source URLs

  1. https://www.sslbox.jp/https://www.sslbox.jp/Service and operation documentation
  2. https://www.sslbox.jp/news_detail.php?view_id=14460https://www.sslbox.jp/news_detail.php?view_id=14460Response evidence

XServer Drive

Response status
Patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official notice confirms patching of PHP used by this service.

Scope: Applies to the service platform's PHP.

What users should do

Check subsequent service notices.

Source URLs

  1. Customer-server PHP security measures, October26https://www.xserver.ne.jp/news_detail.php?view_id=19756Response evidence

XServer Shop

Response status
Patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official notice confirms patching of PHP used by this service.

Scope: Applies to the service platform's PHP.

What users should do

Check subsequent service notices.

Source URLs

  1. Customer-server PHP security measures, October26https://www.xserver.ne.jp/news_detail.php?view_id=19756Response evidence
Related official sources
  1. Xserver: PHP patching and service restorationOfficial noticeNotice updated: 2026-10-23T17:00:00+09:00
  2. Customer-server PHP security measures, October26Official noticeDistinguishes completed managed PHP5.1–8.5 patching from customer-managed VPS.
  3. Star8: Support and PHP settings 1Official information directory
  4. Star8: Support and PHP settings 2Official information directory
  5. Star8Official information directory

Comments