CVE-2026-109618 and CVE-2026-109619
Two new flaws in PHP 8.2 to 8.5 let attackers run their own code on your shop server without logging in and get at customer data and payments. They affect online shops on Shopware, WooCommerce, Magento, PrestaShop, OXID, JTL-Shop, Gambio and other PHP systems. The SecureCommerce Firewall blocks these attacks before they reach your shop, even while the PHP update is still pending.
The firewall stops the attacks even while your server still runs the old PHP version.
You test the PHP update calmly and install it when it suits you, instead of patching under pressure at night.
You do not configure anything. The self-learning filter rules of the SecureCommerce Firewall adapt to new attacks automatically.
When PHP runs out of memory it aborts the current processing abruptly. In some situations the request memory has not been initialised yet. The cleanup that follows then works with this undefined data, and that can be exploited to inject code.
Global state in PHP can keep pointing into memory that was already freed at the end of a request. Later requests read this stale data before it is reset, which can also lead to the execution of foreign code.
Anyone who can run code on the shop server can get at customer data and payment interfaces. They can rewrite delivery addresses, send customers to fake payment pages or leave malware behind.
The flaws are in PHP itself, not in a single shop system. What matters is the PHP version your shop runs on. Only these versions are safe:
| PHP branch | Safe from version |
|---|---|
| PHP 8.2 | PHP 8.2.35 |
| PHP 8.3 | PHP 8.3.36 |
| PHP 8.4 | PHP 8.4.27 |
| PHP 8.5 | PHP 8.5.12 |
This means every PHP-based shop system is affected as long as PHP on the server is not updated: WooCommerce, Magento, Shopware, PrestaShop, OXID eShop, JTL-Shop, Gambio, xt:Commerce, OpenCart, Zen Cart and osCommerce.
PHP 8.1 and older versions such as PHP 7.4 are not listed in the official advisories. They no longer receive any security updates at all, including for future flaws. For shops on outdated PHP, a firewall in front of the shop is the most important layer of protection until an upgrade is possible.
You will find the active PHP version in your hosting control panel, in the admin area of your shop system, via phpinfo() or on the command line with php -v. Check every server, including staging and test systems.
Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart the PHP workers. According to the PHP team the update is the only complete fix. On shared hosting your provider has to roll out the update.
If you cannot update right away, the PHP team recommends limiting requests before they reach PHP: restrict request size, limit input variables, nesting depth and uploads, and block multipart requests where the shop does not need them.
The SecureCommerce Firewall blocks attacks on both flaws. With plug-and-play integration your shop is connected quickly.
The SecureCommerce Firewall protects your shop against these flaws and the next one. With plug-and-play integration your shop is connected quickly, and SecureCommerce runs it as a Managed Service.
Requests are filtered before they reach your shop server. Self-learning filter rules keep suspicious traffic away from PHP.
Included in the Pro and Plus plans: protection against newly disclosed flaws, even before you have been able to update your systems.
Round-the-clock monitoring of your online shop and database servers, so anomalies are caught early.
Detection, blocking and removal of injected malware on your servers.
On request we check your shop in advance with no obligation and agree with you which protection fits.
The SecureCommerce Firewall fends off overload attacks and bad bots, so your shop stays reachable.
Yes. The SecureCommerce Firewall blocks attacks on both flaws before they reach PHP.
Yes, if it runs on PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 or 8.5 before 8.5.12. This applies regardless of the shop system.
The flaws are in PHP, not in the shop system. You need to update PHP on the server. A patch update within the same branch, for example from 8.3.x to 8.3.36, normally does not affect your shop's compatibility.
PHP 7.4 and all versions up to 8.1 are not named in the official advisories. However, they no longer receive security updates, including for future flaws. Plan an upgrade and put a firewall in front of your shop until then.
Send us your shop URL via the contact form. On request we check your shop with no obligation and send you a quote for a suitable protection plan, from €49 per month.
Send us your shop URL. We check your shop with no obligation and get back to you by email with a quote.
Request protection