The core PHP maintenance team has issued an urgent warning regarding two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that require immediate patching.
Sources:
- https://www.php.net/archive/2026.php#2026-10-21-5
- https://www.wordfence.com/blog/2026/10/psa-php-security-updates-available-for-two-critical-vulnerabilities-update-now/
These emergency updates address Remote Code Execution (RCE) flaws, which are among the most severe types of security risks. In practical terms, an RCE vulnerability means an attacker could bypass normal security protocols and run malicious commands directly on your web server.
Left unpatched, this could allow unauthorized individuals to completely take over a website, steal sensitive customer data, or disrupt business operations. These vulnerabilities affect PHP environments globally, including servers utilizing Plesk hosting panels.
Because PHP is the underlying code that powers over 70% of websites, including WordPress, WooCommerce, X-Cart, and Magento, securing this infrastructure immediately is non-negotiable for e-commerce brands.
We are proactively updating PHP 8.2+ on all the servers we manage. Our engineering team is applying these emergency patches as they are released to ensure your hosting environment remains locked down and secure. We handle this critical maintenance behind the scenes so your business experiences zero disruption and your revenue remains protected.
If you are on the latest version of WooCommerce managed by FinestShops, we already updated your server and switched your website to the latest patched version of PHP 8
If your website is not compatible with PHP 8.2+ , like older versions of Magento and X-cart shopping carts, your quickest option to mitigate this vulnerability is to switch DNS to Cloudflare because they already have a WAF filter for the vulnerability; they knew about it and were working on that solution before it became public: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
To do this:
- Open an account with Cloudflare (you can start with free to test and upgrade it later)
- Add our user, devops@finestshops.com, as an admin
- Send us a message at support@finestshops.com or open a new ticket at https://support.finestshops.com/ requesting a switch to Cloudflare.
- We will set up your DNS records in Cloudflare and let you know once this is done.
- If we do not have access to your domain’s records, you will need to log in to your domain’s registrar and update the name servers to the new name servers from Cloudflare.
If you manage your own servers or aren’t sure whether your hosting provider has patched your systems, please contact our support team immediately at https://support.finestshops.com. We will audit your current setup and help you migrate to a secure, enterprise-grade environment.
Stay safe!
Anton Pachkine
www.FinestShops.com
