How pixiv Responded to the Emergency Release of PHP 8.5.12

A fast patch for a serious PHP bug

In October 2026, a serious weakness in PHP, nicknamed PHP2Shell, was found. PHP released an emergency security update. pixiv put its affected services into maintenance mode, then applied the patch as soon as it came out. The whole process, from release to lifting maintenance mode, took about 30 minutes. This was the first PHP upgrade after pixiv moved its servers from bare-metal Apache to Kubernetes.

Key numbers and times

• The security release came out at 22:41. pixiv had planned for 23:00, so the release was earlier than expected.
• Container image build took about 6 minutes (22:42 to 22:56).
• The image is several gigabytes in size.
• Maintenance mode was lifted at 23:16, about 30 minutes after the patch came out.
• pixiv's CI system runs about 50,000 integration tests and finishes them in under 1 minute.

How pixiv prepared before the release

pixiv uses the official PHP image from Docker Hub. Waiting for that image was risky. It might be slow, and many users could hit Docker Hub at once. So the team prepared two paths: one to update the official image, and one to build PHP from source. They reused the official build files and used Docker Buildx Bake so that only the PHP version had to change. They also cached the base image on build nodes ahead of time.

Why this matters

The story shows how a company can respond to a security problem within minutes. Good preparation, fast build machines, and smart caching made the fix possible. Keeping services safe during updates is important because users depend on them every day.

What to watch

• Whether the team shares more details about the problems they hit on the day, such as the maintenance-mode gaps and the slow Pixiv Encyclopedia build.
• How the PECL tool problems are fixed in later updates.
• How pixiv keeps its build speed as its Kubernetes setup grows.