October 2026: critical security fixes for PHP, Java and Node.js, one after another

We take over your old system and make it safe again

"We can't reach the company that built it." "There are no documents." "The person who knew it has left." That's fine. Whether it runs on PHP, Java, Node.js or something else, Digi Dinos reads the code to find out how it works, then handles everything: fixing vulnerabilities, upgrading, and looking after the system from then on.

Takeover & maintenance
Vulnerability fixes
PHP, Java & Node.js upgrades
Lifetime warranty (under contract)

Talk to us See what we do

Just asking is fine. Japanese staff are part of the team, and we speak Japanese, English and Vietnamese.

Does any of this sound familiar?

We can't reach the company that built our system - or it no longer exists
There are almost no specifications or documents left
The person who understood the system has left
We heard about a vulnerability on the news, but don't know if it affects us
We were told our version is old or losing support, but don't know what to do
We have no idea how much a fix would cost
We're worried the website or our work will stop during the fix
We don't know what is going on, or who to ask
Our hosting company told us our old version will soon stop working
We only need a small fix, but can't find anyone willing to take it on
A business partner asked about our security measures and we didn't know what to say
Our system has never had a security check

If even one of these applies to you, talk to Digi Dinos. We'll help you work out where to start.

Why act now?

First, a few terms in plain words.

Vulnerability

A weak spot in a system - a gap that lets attackers get in.

CVE

A worldwide ID number given to each vulnerability that is found.

EOL (end of life)

The makers no longer release fixes. If a new weakness is found, it will not be patched.

PHP, Java, Node.js

Programming languages and platforms that run websites and business systems. A great many systems use them.

Framework

A ready-made foundation for building systems quickly and safely, such as Laravel (PHP) or Spring (Java).

Version upgrade

Replacing a language, framework or server with a newer release. Stay on an old release past its end of support and fixes stop coming.

What happened in October 2026

PHP: two critical flaws, exploited overseas

On October 21 the PHP project disclosed two very dangerous vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell") and released fixed versions. If exploited, an outsider could run their own programs on your server. According to IPA, on October 26 (local time) the US agency CISA added both to its list of known exploited vulnerabilities (IPA says it is not aware of any damage in Japan).

Node.js: 10 issues fixed, 4 rated "high"

The same day, Node.js released security fixes for its three active lines (26.x, 24.x and 22.x). Ten issues were fixed, four of them rated high severity.

Oracle Java: IPA urges prompt updates

On October 21 IPA issued an alert on vulnerabilities in Oracle Java (Java SE). It warns they could make applications crash or let an attacker take control of a computer, and urges users to update promptly.

Japan's government urges businesses to act

On the PHP issue, Japan's Ministry of Economy, Trade and Industry (METI), working with the National Cybersecurity Office (NCO), issued a warning through industry associations, and JPCERT/CC published an alert too. It is not a legal obligation, but businesses are asked to check which version they use, consider updating to the latest one, and check with their web developer or hosting provider.

Old versions get no fix

PHP 8.1 and older, and Node.js 20 and older, are already end of life: when problems like these are found, no regular fix is released. Server operating systems are the same - CentOS 7, for example, reached end of life on 30 June 2024. The PHP project itself says configuration workarounds do not make a server safe; updating is the only safe choice.

More end-of-support dates are coming

PHP 8.2 reaches end of life on 31 December 2026, and Laravel, a framework widely used with PHP, has already stopped security fixes for version 11 and older. If you are going to fix it, an upgrade that looks ahead is the safest choice.

* Information as of 28 October 2026. See the official sources below for details.

Sources (official)

Technologies we handle

Not just PHP. We take over old systems built on the languages, platforms and servers in common use - online shops and CMSs included.

PHP

Custom-built PHP too, and moves off old PHP 5 and 7.

Laravel
CakePHP
Symfony
CodeIgniter
FuelPHP
Zend Framework / Laminas
Custom PHP

Online shops (EC)

Maintenance and upgrades for online shops, including moves off old EC-CUBE.

EC-CUBE (2.x, 3.x, 4.x)
WooCommerce
Magento (Adobe Commerce)

CMS (website management)

CMSs that stopped being updated, and outdated themes and plugins.

WordPress
baserCMS
concrete CMS
Movable Type (Perl)

Java

Business system maintenance and moves off old Java - including Seasar2, which is no longer supported.

Spring / Spring Boot
Struts 1 / 2
Seasar2
JSF
Oracle Java (JRE)

Node.js

Servers and front ends - including moves off unsupported Node.js versions.

Express
Next.js
Nuxt

Python & Ruby

Maintenance and upgrades for web systems and in-house tools.

Django
Flask
Ruby on Rails

.NET / C#

Maintenance and migration of business systems that run on Windows.

ASP.NET Web Forms
ASP.NET MVC
.NET Framework

Older Windows systems

We look inside first, then propose how to keep or move them.

VB
VB.NET
Classic ASP

Front end (JavaScript)

Old screens moved to today's tools - including off Vue 2, which is no longer supported.

jQuery
AngularJS
Vue 2

Databases

Upgrades from old versions and data migration.

MySQL
PostgreSQL
SQL Server

Servers & OS

From unsupported servers to supported environments or the cloud.

CentOS 7
Linux
Cloud such as AWS

Integrations, SSL & domains

Connections to other services, plus https certificate and domain renewals.

External APIs (payments, email, etc.)
SSL certificates
Domains

We also handle technologies and old versions not listed here. Just ask - no pressure.

Ask if we can help

What Digi Dinos does

From the first look to long after the fix - one point of contact, all the way.

1
Takeover investigation

We examine your current system ourselves: the code, servers, database and connections to other services.
2
Diagnosis report

A plain-language report on what is risky and what to fix first, with rough cost and timeline estimates.
3
Urgent vulnerability fixes

The most urgent issues come first: updating to patched versions and quick protective settings.
4
Full upgrade

We move languages such as PHP, Java and Node.js, frameworks such as Laravel, and servers to supported versions, and gradually tidy up old, hard-to-read code (refactoring). Along the way we also lay the groundwork for SEO / GEO.
5
Operation & maintenance

After the fix we keep monitoring, updating and handling problems. When a new vulnerability appears, we check whether it affects you and act.
6
Lifetime warranty

If a defect turns up in anything we worked on, we fix it. The warranty has no end date for as long as your maintenance contract continues.

The "lifetime warranty" applies while your maintenance contract continues. We explain exactly what it covers, in plain words, before you sign.

Get found on Google and in AI search (SEO / GEO)

While we take over and upgrade your site, we also make it easier to find on Google and in AI answers.

SEO: Making your site easier to find on Google and other search engines.
GEO: Generative Engine Optimization: helping AI such as ChatGPT, Gemini and Google's AI Overviews describe your business correctly when they answer.

Why a takeover is the right moment

Old sites are often slow, hard to use on phones, not on https, missing a sitemap or structured data, and full of broken links or missing titles. An upgrade already means working inside the site, so it is the best time to fix all of this at once.

Speed & mobile

A site that loads fast and reads well on phones, including Google's Core Web Vitals metrics.

Core Web Vitals
Mobile-friendly

https & clean-up

Secure https, with broken links and duplicate pages sorted out.

https
Broken links
Duplicate pages

Titles & descriptions

The titles and descriptions shown in search results, rewritten in the words your customers search with.

Titles
Meta descriptions

Sitemap & Search Console

Google is told about your pages properly, and you can see how the site performs in search.

Sitemap
Google Search Console

Structured data & languages

Company details, FAQs and breadcrumbs written in a form search engines and AI understand - plus hreflang for multilingual sites.

Structured data
Company / FAQ / breadcrumbs
hreflang

AI-friendly content & follow-up

A clear structure AI can quote - FAQs, key-point summaries, clear company details - and a look at the numbers after launch.

FAQs
Key-point summaries
Post-launch checks

We can't promise rankings or AI mentions, but we build the foundation that helps people find you.

No documents? Nobody who understands it? No problem.

Old systems often come with no documents and nobody left who built them. Digi Dinos reads the code itself and works out how the system and your business processes fit together.

We read the code

We go through the source code to see what each screen does and how data flows.

We learn the rules from how it runs

By using the screens and looking at the database, we uncover the business rules behind "why it works this way".

We write it all down

Specifications, screen lists, data diagrams and server layouts - documents anyone can follow next time.

A short chat with your staff

Just tell us how you use it day to day. No IT knowledge needed.

No source code or passwords? Fine

We work through the clues with you, such as your server contract details and admin panels.

A complete plan

Based on what we find, we sort out what is urgent, what can wait and what it will roughly cost, and propose a realistic plan.

What you receive after the investigation (examples)

System overview diagram
List of screens and features
Database description
Server and environment list
List of risks and how to fix them
Work plan and cost estimate

How it works

1
Contact us

Use the form and simply write what is on your mind. It doesn't need to be organised.
2
We listen

In an online meeting we hear about your situation and concerns.
3
Investigation & diagnosis

With the information you share, we look inside the system.
4
Proposal & quote

We explain the findings, plan, cost and timeline. Work starts only once you are happy.
5
Fixes & upgrade

We fix things in order of urgency and report progress regularly.
6
Maintenance & warranty

After the fix, monitoring and the warranty continue - search numbers included.

Why Digi Dinos

8 years, 150+ projects

Since our founding in 2018 we have built and maintained web systems for Japanese clients.

Communication in Japanese

Japanese staff take part directly in meetings and contact with you. Together with our Japanese-speaking members, you can work with us in Japanese from start to finish. We also have an office in Yokohama.

Offshore, so costs stay down

Our development team in Vietnam does the work, which keeps costs down without cutting quality.

Your information is safe

We are certified to ISO/IEC 27001, the international information security standard.

One contact, start to finish

Digi Dinos handles investigating, fixing and looking after your system, so you never have to explain it all again to another company.

Plain words, no jargon

We choose our words so that people without an IT background can follow.

Plain-language guides on vulnerabilities and upgrades for older systems - useful background before you discuss it internally or talk to us.

Frequently asked questions

QHow much does it cost?

It depends on the size and condition of the system. We listen first, look inside, and then give you a quote. We never start work before you agree.

QHow long does it take?

It depends on the size of the system. We give you a concrete schedule after the investigation. Urgent vulnerability fixes come before everything else.

QWill the website or our work stop during the fix?

We work in ways that avoid downtime. We make and test changes in a separate environment before switching over, so any stop is short. If a stop is unavoidable, we agree on it with you in advance and do it at a quiet time.

QWe don't know where the source code is or what the server password is.

That's fine. We work through the clues with you, such as server contracts and admin panels. Just tell us what you do know.

QWe have no documents at all. Will you still take it on?

Yes. We read the code to find out how it works and write the documents ourselves.

QCan you handle old versions of EC-CUBE?

Yes. We can maintain and patch EC-CUBE 2.x and 3.x, and help you move to the current version (4.x). We look at your customisations and plugins first, then propose how to proceed.

QCan you also help with SEO and AI search (GEO)?

Yes. Alongside the takeover or upgrade we improve speed, mobile display, titles and descriptions, sitemaps and structured data. We can't promise rankings, but we build the foundation that helps people find you on Google and in AI answers.

QWe don't even know what our system is built with.

That's fine. Finding out which languages and frameworks it uses is where we start.

QWe are not IT people. Is that OK?

Of course. We avoid jargon and explain things in plain words.

QCan we talk to you in Japanese?

Yes. Japanese staff take part directly in meetings and contact with you, alongside our Japanese-speaking members, so everything can be in Japanese from start to finish. English and Vietnamese are fine too.

QWhat is the "lifetime warranty"?

If a defect turns up in anything Digi Dinos worked on, we fix it. It has no end date for as long as your maintenance contract continues. We explain exactly what it covers before you sign.

QCan we switch from our current maintenance company?

Yes. We help with the handover arrangements too.

Talk to us - no pressure

Even a small question like "Is our system OK?" is welcome. We'll hear about your situation and work out the next step together.