site platform

makeshop: security status

patchedofficial notice · 2026-10-23

Summary

Official notice (addendum Oct 23 15:00): emergency maintenance for the critical PHP vulnerability ran on all shop and mail servers from 23:00 on Oct 21 and finished at 04:42 on Oct 22. Admin panel and shop sites work normally; no unauthorized access or leak of customer or order data confirmed. The roundcube webmail check and access statistics features were withdrawn as a result. Mail delivery plus recovered on Oct 23. No PHP version is stated.

Customer action:

No special action needed by shops. If you received two-step authentication mail through roundcube, change the admin email address to another mailbox.

Source: https://www.makeshop.jp/main/support/maintenance/info_detail.html/20261021182632.html
Verified: 2026-10-24

Shops run on the vendor's servers and the vendor manages PHP. Recognised by name servers (ns.makeshop.jp) or CNAME (shopid.cn.makeshop.jp). The bare-domain redirect A records are on AWS (AS16509), so the ASN does not identify makeshop.

How this tool recognises the provider

Name servers: *.makeshop.jp
CNAME: *.cn.makeshop.jp

Report a correction (GitHub)