Overview

In October 2026, vulnerabilities in PHP and Node.js were disclosed. We investigated their impact on HireRoo and took the necessary actions.

Our investigation found that the PHP vulnerabilities do not affect our services; nevertheless, we have also updated PHP to the patched version. As for the Node.js vulnerabilities, part of our services was in an affected configuration, and we completed the update to the patched version on October 22, 2026.

In addition, no traces of unauthorized access or attacks exploiting these vulnerabilities have been identified.

Affected Vulnerabilities

Impact on Our Services

PHP

In HireRoo coding tests, we use PHP to run the code written by candidates. This code runs inside a temporary sandbox environment created for each test session, and the sandbox environment is isolated from our service databases and other systems.

These vulnerabilities can be exploited only when PHP is handling external requests as a web server. Our use of PHP does not involve this, so these vulnerabilities do not affect our services.

Node.js

Part of our services was in a configuration affected by these vulnerabilities.

Actions Taken

PHP

As described above, we use PHP only inside an isolated sandbox environment, so our services are not affected by these vulnerabilities. Nevertheless, we have updated PHP to the patched version.

Node.js

We completed the update to the patched version for the parts affected by these vulnerabilities on October 22, 2026.

Unauthorized Access

We investigated access logs, system operation records, and external communication records for the past 90 days (July 24 to October 22, 2026), including the period before the vulnerabilities were disclosed.

As a result, no traces of unauthorized access or attacks exploiting these vulnerabilities have been identified.

Going Forward

We will continue to monitor information about vulnerabilities and promptly take any necessary measures.