Kodomon Shuts Down Services Early Over PHP Vulnerability, Citing 'Damage Can't Be Undone Once It Happens'

What happened

Codomon runs software that daycare centers and schools use to track when children arrive and leave, and to contact parents. On October 21, it stopped all of its services as a precaution. The reason was two reported security holes (called vulnerabilities) in PHP, a programming language used to build websites and apps. Codomon announced the stop on its official X (formerly Twitter) account at 2:16 p.m. It said it was protecting the safety of people's information. The company made the choice before a fix for PHP was released, because it feared hackers could break in first.

Key numbers and facts

• Services stopped: all, from October 21, 2026, starting at 2:16 p.m.
• The PHP fix was released around 11 p.m. that same day, about 9 hours after Codomon stopped its services.
• Main services came back at 3:22 a.m. on October 22, after the fix was applied.
• The child-attendance alert feature stayed off all of October 22 and was planned to return on October 23.
• As of October 22, Codomon had found no unauthorized access or information leaks linked to this issue.

Why it is a big deal

PHP is widely used, so a serious flaw can affect many services at once. When a flaw is rated as urgent, companies must choose quickly between staying online and risking an attack, or shutting down and upsetting users. Several other well-known services also planned emergency maintenance around the same time.

Why it matters

Codomon said that if personal data leaked, the damage could never be fully undone. So it chose to stop services first, even though this caused trouble for schools, staff, and parents. The case shows how companies may weigh short-term pain against the risk of permanent harm to people's private information.

What to watch

• Whether the child-attendance alert feature returns on October 23 as planned.
• Codomon's explanation, which ITmedia said it would ask the company for in more detail.
• Whether any unauthorized access or data leaks are reported later.
• How other companies handle the same PHP flaw.