hosting

Movable Type Cloud (Six Apart): security status

patchedofficial notice · 2026-10-22

Summary

Official (Oct 22): at 00:12 on Oct 22 Movable Type Cloud's PHP was updated to 8.3.36, completing the fix for CVE-2026-109618 and CVE-2026-109619 in every customer environment, including those with auto-update disabled. The release notes say the update was from 8.3.31 and that session.upload_progress.enabled was set to 0. The Movable Type version number itself did not change. An addendum on Oct 26 says the same maintenance also fixed CVE-2026-115560, a further PHP vulnerability published on Oct 23.

Customer action:

No action for Cloud customers. If you run the software or AMI edition on your own server, update the server's PHP itself (not Movable Type) to a fixed release.

Source: https://www.sixapart.jp/movabletype/news/2026/10/22-0020.html
Verified: 2026-10-26

Kind is hosting because Six Apart manages PHP on each customer instance. Recognised by CNAME to *.movabletype.biz; bare domains use an instance-specific IP and are not recognised. MovableType.net is a separate service.

How this tool recognises the provider

CNAME: *.movabletype.biz

Report a correction (GitHub)