hosting
Lolipop (GMO Pepabo): security status
Summary
Official report (Oct 22): PHP 8.2-8.5 updated to the upstream fixed releases (8.2.35/8.3.36/8.4.27/8.5.12); 7.4/8.0/8.1 received the upstream fix code for EOL branches; 5.3-7.3, which have no official fix, received Lolipop's own fix based on the upstream one. session.upload_progress is disabled on every version. Customer sites on some servers were taken offline from about 03:09 on Oct 22 and restored at about 13:00. Exploit attempts were seen, but no unauthorized access or data leak has been confirmed. Because the older branches were patched in place, the notice does not say whether their displayed version number changes.
Customer action:
Switch each domain to PHP 8.2 or later on the user page; the fixes for 8.1 and older are temporary. Check that WordPress core, plugins and themes are current and still maintained, and test page display, contact forms and file uploads.
Source: https://lolipop.jp/info/news/8239/
Verified: 2026-10-24
Customer name servers are uns01/uns02.lolipop.jp; Muumuu Domain users can pick Lolipop directly. Lolipop does not publish the AS of its web servers; its customer servers are observed in GMO Internet's AS7506, so the name servers decide between it and the other GMO services there.
How this tool recognises the provider
- AS numbers
AS7506- Name servers
*.lolipop.jp