hosting
Xserver: security status
Summary
Official notice (dated Oct 21, covering completion on Oct 26): on Xserver, XServer Business and XServer for WordPress, mitigations were in place by 12:00 on Oct 21; after the fixed releases came out around 23:00 that day, fixes were rolled out starting with PHP 8.2-8.5 and extended to older end-of-life versions, reaching all target servers for PHP 5.1-8.5 by 06:20 on Oct 26. 8.2-8.5 were moved to fixed releases of the same branch; 5.1-8.1 were patched without changing the version, so an older-looking version number is expected. This notice gives no per-version completion times. XServer VPS products are not patched by Xserver; customers manage PHP there.
Customer action:
No urgent PHP version change is needed for this fix (5.1-8.5 are all patched). The vendor may announce extra steps depending on usage. PHP 8.1 and older are out of upstream support, so plan a move to a supported PHP after a backup and test. XServer VPS customers must check and update PHP themselves.
Source: https://www.xserver.ne.jp/news_detail.php?view_id=19756
Verified: 2026-10-26
Operated by Xserver Inc. Star Rental Server, Shin Rental Server and wpX Speed run in the same network (AS131965). Star customers are recognised by their name servers; Shin Rental Server and wpX Speed share their name servers (ns1-3.wpx.ne.jp), cannot be told apart, and show as Xserver.
How this tool recognises the provider
- AS numbers
AS131965- Text in the AS name
XSERVER- Name servers
*.xserver.jp*.xtwo.ne.jp