---
title: Uravation releases free emergency response kit for PHP and Node.js vulnerabilities
url: https://www.dataloco.com/en/uravation-releases-free-emergency-response-kit-for-php-and-nodejs-vulnerabilities
published: 2026-11-09T22:21:13+00:00
language: en
section: Security
source: https://ascii.jp/elem/000/004/449/4449526/?rss
organizations: Uravation, IPA, CISA
publisher: Dataloco
---

# Uravation releases free emergency response kit for PHP and Node.js vulnerabilities

Uravation has made a free emergency response kit available for organizations managing PHP, WordPress, and Node.js systems. The resource was released on October 25, 2026, to assist web administrators and information systems departments in handling urgent security patches. The kit provides a structured approach to verifying system versions, determining responsibility for fixes, and documenting actions taken during a vulnerability event.

The release follows the disclosure of two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. The PHP development team released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. These vulnerabilities allowed remote code execution without authentication. On the same day, Node.js also issued a security update. The Information-technology Promotion Agency of Japan, known as IPA, had previously called for organizations to inventory their PHP usage before the fixes were published.

On October 27, 2026, the IPA noted that the United States Cybersecurity and Infrastructure Security Agency, or CISA, added the two PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26. The IPA stated that it is not aware of any attack incidents within Japan but reiterated the need for organizations to migrate to the patched versions. The agency emphasized the importance of verifying which sites are affected and ensuring that updates are applied correctly.

The response kit is designed to address common challenges faced during emergency patching. These include the inability to quickly identify which sites run which versions of PHP, the lack of clear division of labor between internal teams and external providers, and the absence of records for verification and communication. The kit includes a 32-page PDF guide, Excel templates for asset ledgers and checklists, and Word templates for incident records and communication drafts.

The guide outlines a seven-step process for handling emergency vulnerabilities. The steps involve receiving the alert, determining if the system is affected, applying the fix, implementing temporary measures, verifying that the system has not been compromised, confirming the ability to roll back changes, and documenting the response. The kit also includes specific instructions for verifying versions through administrative interfaces, command lines, and server management panels for various operating systems and environments.

For organizations that outsource maintenance, the kit provides a framework for communicating with service providers. It suggests asking three specific questions: whether the provider is affected, the schedule and status of the update, and what actions the client must take. The kit also includes guidance on using AI agents for specific tasks, such as summarizing alerts and inventorying versions, while maintaining human oversight for critical actions like production changes and external communications.

The resource is available for free download from the Uravation website. It is intended for web administrators, information systems staff, and web production companies that manage client sites. The kit is based on information verified from official pages on October 22, 2026, and users are advised to check the latest official announcements before use. The document is not legal advice and does not replace professional vulnerability assessments or penetration testing services.