Looking Back on Our Response to PHP2Shell - Codmon Product Team Blog

What happened

Kodomon's product team looked back at how it responded to PHP2Shell. The team paused its services in the daytime on October 21 to protect data. No attack happened, and no leaks were found. The team said the pause was sudden, and it apologized to schools, parents, and partners for the trouble and the short notice.

Key facts

• The PHP flaw was rated 9.2 out of 10, the highest "Critical" level.
• Two security IDs were involved: CVE-2026-109618 and CVE-2026-109619.
• The PHP team announced the flaw at 4:33 a.m. Japan time and planned to release a fix at 11 p.m. the same day.
• Most services were back by 3:22 a.m. on October 22. Some came back later, and the attendance alert feature returned on October 23 at 9:00 a.m.

Why the timing was unusual

Usually, when a serious flaw is fixed, the details are published at the same time as the fix. That way, companies can patch right away. This time, the details spread online before the fix was ready. Some security firms even said they had reproduced the problem. Kodomon could not patch yet, but attack clues were already public. This is why it chose to stop services during the day.

Why it matters

The story shows the hard choice companies face. They must protect children's and families' data, but they also must keep services running for daily school work. Parents and teachers lost access to records, messages, and payments for a long time. The team also said it should have given more notice, and it shared its lessons so other teams facing similar problems can learn from them.

What to watch

• Whether Kodomon confirms that no data was leaked after the review.
• How the company changes its plans for emergencies in the future.
• Whether PHP changes how it shares security details before fixes are released.