This notice describes CheckBack's response to the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 / CVE-2026-109619, known as php2shell).
Patch status
The PHP project released patched versions at around 11:00 p.m. JST on Wednesday, October 21. CheckBack completed applying them to the production environment late at night on Thursday, October 22. This covers all CheckBack servers that use PHP, and we have confirmed that the patched version is running on each of them.
Additional measures
We also applied a mitigation officially recommended by the PHP project that does not affect CheckBack features (disabling a PHP feature used in one of the attack paths).
Impact on the service
The update was performed late at night without stopping the service. Since the update, we have observed no increase in errors or any functional issues.
Signs of unauthorized access
We reviewed our AWS security monitoring service and application logs before and after applying the patch. Within the scope of our review, we found no signs of unauthorized access or tampering. Alongside this response, we have also strengthened monitoring to detect suspicious activity inside our servers, and we will continue this monitoring going forward.
Action required
No action is required on your part. You can continue to use CheckBack as usual.