Kyushu University Information Infrastructure Initiative Hosting Service
Information
Posted October 23, 2026 [Notice of Resolution] Regarding a Critical PHP Vulnerability in PHP
To All Web Hosting Administrators
We would like to inform you that the hosting system has completed addressing the vulnerability in the software (PHP) used by our web hosting service.
We had previously asked all users of our web hosting service to request access restrictions while the vulnerability was being addressed. Now that this issue has been resolved, we will lift the access restrictions that were in place on the morning of Monday, October 26.
If you wish to have the restrictions lifted earlier, please contact the Network Business Office of the Information Infrastructure Initiative (n-room@iii.kyushu-u.ac.jp).
Please note that for all versions of PHP available for selection via the method described in the following manual for Web Hosting (cPanel), security patches have already been applied.
○Domain Administrators Manual (cPanel)
https://hosting.iii.kyushu-u.ac.jp/english/qdai-only/HostingAdminManual_EN.pdf
・7.4 Updating system PHP version
Thank you very much for your understanding and cooperation regarding this matter.
To All Web Hosting Administrators
We would like to inform you that the hosting system has completed addressing the vulnerability in the software (PHP) used by our web hosting service.
We had previously asked all users of our web hosting service to request access restrictions while the vulnerability was being addressed. Now that this issue has been resolved, we will lift the access restrictions that were in place on the morning of Monday, October 26.
If you wish to have the restrictions lifted earlier, please contact the Network Business Office of the Information Infrastructure Initiative (n-room@iii.kyushu-u.ac.jp).
Please note that for all versions of PHP available for selection via the method described in the following manual for Web Hosting (cPanel), security patches have already been applied.
○Domain Administrators Manual (cPanel)
https://hosting.iii.kyushu-u.ac.jp/english/qdai-only/HostingAdminManual_EN.pdf
・7.4 Updating system PHP version
Thank you very much for your understanding and cooperation regarding this matter.
Posted October 21, 2026 [Important] Regarding a Critical Vulnerability in PHP
To All Web Hosting Administrators
Kyushu University CSIRT has issued a security advisory regarding a vulnerability in the software (PHP) used by web hosting services.
・Kyushu University CSIRT
Regarding PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619: “php2shell”)
https://www.sec.kyushu-u.ac.jp/information/administrators-en/2927/
We are making arrangements to ensure that our hosting systems can implement prompt countermeasures as soon as details regarding the PHP vulnerability are made public.
◆Regarding Access Restrictions
As stated in the notification from Kyushu University CSIRT, users of our web hosting services can set access restrictions until the vulnerability has been fully addressed.
Hosting administrators who wish to implement access restrictions should contact the Network Operations Office, Information Infrastructure Initiative (n-room@iii.kyushu-u.ac.jp).
When contacting us, please provide the URL of the affected website and confirm that you are using our web hosting service. Then, specify one of the following options as the scope of the access restriction:
Please specify one of the following options as the scope of the access restriction:
1. Accessible only from within the university
2. Accessible only from within Japan (100% access from within Japan is not guaranteed)
To All Web Hosting Administrators
Kyushu University CSIRT has issued a security advisory regarding a vulnerability in the software (PHP) used by web hosting services.
・Kyushu University CSIRT
Regarding PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619: “php2shell”)
https://www.sec.kyushu-u.ac.jp/information/administrators-en/2927/
We are making arrangements to ensure that our hosting systems can implement prompt countermeasures as soon as details regarding the PHP vulnerability are made public.
◆Regarding Access Restrictions
As stated in the notification from Kyushu University CSIRT, users of our web hosting services can set access restrictions until the vulnerability has been fully addressed.
Hosting administrators who wish to implement access restrictions should contact the Network Operations Office, Information Infrastructure Initiative (n-room@iii.kyushu-u.ac.jp).
When contacting us, please provide the URL of the affected website and confirm that you are using our web hosting service. Then, specify one of the following options as the scope of the access restriction:
Please specify one of the following options as the scope of the access restriction:
1. Accessible only from within the university
2. Accessible only from within Japan (100% access from within Japan is not guaranteed)
Posted on December 3, 2025 [Introduction of Two-Factor Authentication for Web Hosting Services]
In recent years, the risk of unauthorized access due to password leaks and other issues has increased. Therefore, to enhance security, we have introduced two-factor authentication for logging into cPanel and Webmail as described below. We kindly ask all email address users to be aware of this change.
Details
◆Applicable Services
・cPanel (Hosting Service Management Interface)
・Webmail
◆Impact
・A 2-factor authentication setup menu has been added to cPanel and Webmail.
・Once users configure 2-factor authentication, subsequent logins will require entering a security code in addition to the ID and password.
・Login will remain possible as before unless users configure this setting.
・This change does not affect FTP account usage. (No action is required.)
◆Configuration Method
Please refer to the procedure manual uploaded below for configuration details.
・How to Set Up Two-Factor Authentication
◆Important Notes
・A smartphone is required for setup. Please note that two-factor authentication cannot be used without a smartphone.
In recent years, the risk of unauthorized access due to password leaks and other issues has increased. Therefore, to enhance security, we have introduced two-factor authentication for logging into cPanel and Webmail as described below. We kindly ask all email address users to be aware of this change.
Details
◆Applicable Services
・cPanel (Hosting Service Management Interface)
・Webmail
◆Impact
・A 2-factor authentication setup menu has been added to cPanel and Webmail.
・Once users configure 2-factor authentication, subsequent logins will require entering a security code in addition to the ID and password.
・Login will remain possible as before unless users configure this setting.
・This change does not affect FTP account usage. (No action is required.)
◆Configuration Method
Please refer to the procedure manual uploaded below for configuration details.
・How to Set Up Two-Factor Authentication
◆Important Notes
・A smartphone is required for setup. Please note that two-factor authentication cannot be used without a smartphone.
Posted January 8, 2026 [Regarding Shibboleth Authentication Issues]
- Period
Approximately 12:40 PM on December 16, 2025, to approximately 1:30 PM on January 7, 2026 (partially restored around 4:49 PM on December 22, 2025)
We sincerely apologize for any inconvenience caused.
Please verify your website's functionality. If you encounter any issues, please notify your hosting support representative.
- Period
Approximately 12:40 PM on December 16, 2025, to approximately 1:30 PM on January 7, 2026 (partially restored around 4:49 PM on December 22, 2025)
We sincerely apologize for any inconvenience caused.
Please verify your website's functionality. If you encounter any issues, please notify your hosting support representative.
Posted on April 1, 2025 [Regarding garbled characters in mailing lists]
Since around Monday, March 17th, we have been aware of an issue where emails posted to mailing lists created with email hosting services have arrived with garbled characters.
An investigation revealed that this is a bug in the mailing list software. The developer appears to be working on it, but there is currently no indication of a resolution.
The developer has currently announced the following workarounds. We apologize for any inconvenience, but if you experience garbled characters in mailing lists, please try one of the following on the sender's side:
- Set the character encoding when sending to ISO-2022-JP (JIS).
- Use HTML instead of plain text when sending.
Since around Monday, March 17th, we have been aware of an issue where emails posted to mailing lists created with email hosting services have arrived with garbled characters.
An investigation revealed that this is a bug in the mailing list software. The developer appears to be working on it, but there is currently no indication of a resolution.
The developer has currently announced the following workarounds. We apologize for any inconvenience, but if you experience garbled characters in mailing lists, please try one of the following on the sender's side:
- Set the character encoding when sending to ISO-2022-JP (JIS).
- Use HTML instead of plain text when sending.
Posted on July 29, 2020 We have launched the Kyushu University Primary Mail Service for Subdomains.
This service accepts email addresses in the kyushu-u.ac.jp subdomain (department domain) via the Kyushu University Primary Mail Service, allowing department domain email addresses to be received simultaneously in the mailbox of the Kyushu University Primary Mail Service.
Email users are managed using an SSO-KID , reducing the burden on department administrators compared to email hosting services.
For more information, please see the following webpage:
https://ci.iii.kyushu-u.ac.jp/m/submail/
This service accepts email addresses in the kyushu-u.ac.jp subdomain (department domain) via the Kyushu University Primary Mail Service, allowing department domain email addresses to be received simultaneously in the mailbox of the Kyushu University Primary Mail Service.
Email users are managed using an SSO-KID , reducing the burden on department administrators compared to email hosting services.
For more information, please see the following webpage:
https://ci.iii.kyushu-u.ac.jp/m/submail/
What is a Hosting Service?
In recent years, exchanging information via email over the Internet and disseminating information via the World Wide Web have become essential for everyday work and research. However, the increase in security threats on the Internet has made it more difficult for departments to manage their own servers.
In response to this, the Hosting Department of the Information Infrastructure Initiative provides hosting services for mail servers, web servers, and DNS servers. By using this service, departments and organizations can use their preferred domain names to access email and publish web pages without having to manage the server's operating system or software.
Additionally, we implement the following hosting security measures:
- Open only the minimum necessary ports and block unnecessary ports
- Software updates are applied automatically
- Incoming emails are checked for viruses and spam by the Information Infrastructure Initiative virus and spam check service.
- Unauthorized access detection
What you can do with the Hosting Service
With the Hosting Service, the management software called cPanel allows you to mainly do the following:
- You can set up a web server or mail server with your desired domain name.
- Various settings can be made via the web browser on the user's computer.
- Department administrators can register, delete, and change department users and mailing lists.
- Email and web can be shared within the same domain's storage limits.
- Automatic forwarding to another mail server is possible. For example, you can use the service that only automatically forwards to the university-wide basic email address. For example, you can use the service that only automatically forwards to the Kyushu University Primary Mail Service email address.
- You can use webmail.
- Content updates (file transfers) on the web server can be performed using encrypted communication such as WinSCP.
- The web server also supports scripting languages such as Perl and PHP, CMS such as WordPress, and databases such as PostgreSQL and MySQL.
- DNS management is possible. However, because reverse lookup cannot be set by department administrators due to specifications, reverse lookup can be provided upon request if necessary.
Kyushu University Information Infrastructure Initiative Network Business Office Hosting Section (it-room(a)iii.kyushu-u.ac.jp)