This vulnerability could allow an attacker to run arbitrary code remotely without authentication. We took the following steps for all Homuta applications, and all customer servers and services entrusted to us, that run PHP.

1. Emergency interim measures

Websites (primarily serving pages)

We applied an interim setting that disables the PHP feature used to exploit the vulnerability (the upload progress feature, session.upload_progress). We also restricted delivery to our caching proxy only, serving just the HTML pages generated by PHP, so that the sites could stay online.

Applications

After applying the same interim setting, we temporarily took applications offline until we could confirm that the vulnerability could be addressed. For customers who needed continuous access, we restricted access by IP address—except for publicly offered services—and blocked all traffic from addresses other than those permitted.

2. Permanent fix (applying the patched PHP)

Until the fixed PHP packages were published in the Linux distribution repositories, we checked their availability every five minutes, and applied each fix as soon as it was released for the corresponding operating system. Patching of all servers was completed by 4:00 a.m. JST on October 22. We then brought services back online one by one as we confirmed they were unaffected, and all work was complete by 4:20 a.m. JST.

3. Next steps

This time, the caching proxies we had prepared in advance allowed most services to stay online. However, because we had no way to switch the delivery routes of multiple services at once, the DNS changeover took 25 minutes. We will automate these switching operations so that, should a similar situation arise, we can respond even faster and without interrupting service.

We sincerely apologize to customers inconvenienced by the temporary shutdowns and access restrictions. For inquiries about this matter, please contact your Homuta representative or use our contact form.

Homuta Holdings Inc.