On October 21, 2026, the PHP project released fixes for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The flaws may affect both integrations that use PHP and stores running WooCommerce, PrestaShop, and Adobe Commerce/Magento.

To check your integration, ask your hosting provider or technical team to prioritize reviewing the PHP version in use and the fixes applied. If the installation remains vulnerable, arrange an update to a patched version compatible with your integration.

The versions announced by the PHP project are:

Your hosting provider may offer a package containing the fixes under a different version number. In that case, ask them to confirm that the fixes for both vulnerabilities have been applied.

• Check the PHP installation used on the server. Ask your hosting provider, agency, or technical team to identify the version and confirm the fixes. Request an update to a patched version compatible with the platform, themes, plugins, and integration.
• Check the alternatives for PHP 8.1 or earlier. These versions are no longer covered by the PHP project's regular support. Ask your hosting provider whether a package containing the fixes is available, or request a prioritized migration plan.
• Prepare the update before changing production. Create a backup and verify that the store or application, checkout, and payments work correctly in a test environment.
• If the fixes cannot be applied immediately, request a timeline and temporary measures. Ask your technical administrator to assess measures to reduce exposure, such as a web application firewall (WAF). These measures do not replace the update or make the installation safe.
• If you suspect the environment has been compromised, contact your technical team immediately. Ask them to investigate, secure the environment, and replace potentially exposed credentials, including passwords and integration tokens. Coordinate replacement with containment and recovery: new credentials can be captured if the environment remains compromised.

If you are unsure which version is in use or whether the fixes have been applied, forward this notice to your hosting provider, agency, or the team responsible for your integration.

The versions and update guidance are available in the official PHP security advisory. See also:

• Technical advisory for CVE-2026-109618
• Technical advisory for CVE-2026-109619