On October 21, 2026, the PHP security team announced two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). They allow an attacker on the internet to run their own code on your server without logging in.

For a Magento store, that could mean changed pages, stolen customer and order data, or malicious code placed on your checkout to capture card details. Cloudflare reports that the attacks have already started.

Since Magento runs on PHP, your store is at risk if your server uses an unpatched PHP version.

Important: These vulnerabilities are in PHP itself, not in Magento. Updating Magento or your extensions will not fix them. PHP must be updated on your server.

What Should You Do Now?

Check your PHP version and apply the security update immediately if you can do it at your own without creating any other tech issues or contact us to get the things done smoothly.

Need Help Securing Your Magento Store?

Our developers and DevOps engineers can check which PHP version your store runs, apply the security update, and handle a full PHP upgrade when your version has no fix — including extension compatibility and testing after the update.