Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619: What Store Owners Need to Know

On 21 October 2026, the PHP Security Team announced security updates for two critical PHP vulnerabilities. We have implemented all additional mitigation measures and have rolled out the corrected PHP packages for all relevant versions. All mitigations and patches are now in place across the platform.

Key Information

  • Hypernode has handled the required PHP security updates at platform level.
  • We implemented additional protection through PHP configuration changes.
  • Customers with Hypernode PHP Extended Support were also covered.
  • You did not need to make any changes yourself, and no further action is required for your store.

What were the vulnerabilities?

CVE-2026-109618 and CVE-2026-109619 affected the PHP runtime and were classified as critical. Under certain conditions, they could allow an attacker to execute malicious code.

To address the vulnerabilities, the corrected PHP packages had to be installed for the relevant versions. We deployed them as soon as they became available. The additional mitigation measures reduced risk in the meantime, but did not replace the security updates.

For further details, see the official PHP Security Team announcement and Sansec’s technical analysis (see “Where can I find more information?”).

What mitigation measures did Hypernode implement?

We took a layered approach to help protect our platform.

1. PHP configuration changes

We applied the following PHP settings as additional mitigation measures:

session.upload_progress.enabled = 0
session.use_strict_mode = 1

These settings were completely deployed platform-wide on 21 October at 10:30 AM. The changes were rolled out in stages, first to test and staging environments and then to live systems.

These settings restricted certain attack paths. They did not fully remediate the vulnerabilities and did not replace installing the corrected PHP packages.

2. Additional infrastructure-level measures

We assessed and implemented additional security rules to further restrict potential attacks. These measures complemented the PHP configuration changes and the security updates.

3. PHP security updates

As soon as the corrected packages became available for the relevant PHP versions, we rolled them out across the platform. All relevant versions have been patched.

How did the rollout work? Was there any disruption?

The changes were rolled out in stages through test and staging environments before being applied to live systems. We checked system functionality, including web checks.

A rollback was available had issues arisen, but it was not needed. Applying the changes required a PHP restart, which caused, at most, a brief interruption. We kept the impact on store availability to a minimum.

What about PHP versions that no longer received official security updates?

PHP itself does not provide Long-Term Support (LTS) versions.

For customers who purchased Hypernode PHP Extended Support, we provided security backports through our partner Freexian for PHP versions that no longer received official security updates, including relevant versions running on operating systems that no longer received official updates.

These backports took longer to become available than the official PHP security updates. We coordinated their deployment on the platform as soon as the relevant patches were available. All extended-support versions have been patched as well.

Can I re-enable the PHP settings myself?

We disabled session.upload_progress.enabled and enabled session.use_strict_mode as additional mitigation measures while the corrected PHP packages were pending.

Now that the corrected PHP packages have been installed, these mitigations are no longer strictly required, but they remain in place as defense in depth. If your store specifically requires session.upload_progress.enabled, please contact our support team at support@hypernode.com and we will coordinate the change with you.

Did I need to update my store myself?

No. Hypernode handled the required PHP security updates at platform level. No action was required from you. If any additional steps had been needed for your specific store, we would have coordinated them with you.

When were the security updates installed?

The PHP Security Team released the security updates on 21 October 2026 at 14:00 UTC.

The corrected packages became available at different times depending on the PHP version. We monitored availability and deployed the updates across the platform as quickly as possible. All relevant PHP versions were patched by the end of 21 October 2026.

Where can I find more information?