hosting
CPI (KDDI Web Communications): security status
Summary
Official (updated Oct 29 19:00): SV-Basic, Business Standard and CHM-11Z to 23Z got the fixed releases 8.2.35, 8.3.36 and 8.4.27 on Oct 22. ACE01 (contracts Sep 2015 to Sep 2019) got patched 7.4.34 and 8.0.30 on Oct 27. On Oct 29, 7.4.x on SV-Basic, Business Standard (contracts Sep 2022 to Dec 2025), CHM-11Z to 13Z and CHM-21Z to 23Z was moved to patched 7.4.34. Other old versions and legacy plans (G, X, Z, ZZ, ACE01 before Sep 2015, Pro, V, MG, CHM, CHM-S, CHM-Z etc.) get no patch; customers are told to apply php.ini mitigations. CPI itself changed the php.ini defaults as a mitigation for every PHP version on ZZ, ACE01 (contracts Oct 2011 to Sep 2015), CHM01-03, CHM-01S-03S, CHM-01Z-03Z and MG01-05, and the Oct 29 update extends this to the unpatched versions (such as 8.0.30 and 8.1.33) on ACE01 (contracts Sep 2015 to Sep 2019), SV-Basic, Business Standard (contracts Sep 2022 to Dec 2025), CHM-11Z to 13Z and CHM-21Z to 23Z; a php.ini placed by the customer takes precedence. The G, X, Z, Pro and V series are not listed. The resumed control panel may show the pre-update version number, but the patch is applied. Customer servers were not stopped; no unauthorized access confirmed.
Customer action:
Check your plan and PHP version. On a version without the patch, switch to a patched version on your plan (8.2.35/8.3.36/8.4.27/7.4.34; 8.0.30 is patched only on ACE01 contracted Mar 2018 to Sep 2019; a .htaccess change is needed if the major or minor version changes), or consider moving to Business Standard. Where you cannot switch, or the plan gets no patch, apply the php.ini settings in the notice (e.g. session.upload_progress.enabled = Off). On the plans where CPI changed the php.ini defaults, a php.ini you placed yourself overrides them, so check its values. CPI does not support php.ini changes. The panel may show an old version even where the fix is applied.
Source: https://www.cpi.ad.jp/news/support-info/261022/
Verified: 2026-10-30
Covers shared and managed dedicated plans. Offered PHP versions and patch status differ by plan and contract period.
How this tool recognises the provider
- AS numbers
AS9597- Name servers
*.cpi.ad.jp