What is the issue with PHP?
PHP is software used to run many websites, including online storefronts. Two new security vulnerabilities was recently discovered which could allow an attacker to inject code directly to an affected PHP server without needing to log in. This could allow them to compromise an online store, interrupting sales and putting customer information at risk.
Does this affect Paymentsense products?
These vulnerabilities are specifically to do with PHP, and are not linked with any risk to Paymentsense products.
Does this mean my store is already compromised? What do I do next?
This page is not a confirmation that your storefront has been compromised. Even if you have received this page directly from us, this still does not mean that your store has been compromised.
However, you should still ensure your online storefront is updated as soon as possible. Your approach can depend on how you run your store.
If you integrate your Paymentsense products with a hosting provider plugin:
Paymentsense integrates with the following providers:
- WooCommerco
- Magento/Adobe Commerce
- Opencart
- CS Cart
Please contact your hosting providers now. Ask them to confirm if any PHP software involved in running your online store has been updated with the fixes for both PHP security vulnerabilities.
If your online store is independently run:
- Get in touch with your developer or hosting provider (even if they automatically manage updates for you)
- Request confirmation that the PHP environment serving your store has fixes for both CVE-2026-109618 and CVE-2026-109619. If they have not or are unsure, ask them to apply the fixes immediately using guidance provided by PHP or the relevant hosting provider.
- If your provider or developer are unable to update promptly, request a safe remediation plan and, if possible, reach out to any technical support you have available. Temporary workarounds will not fully resolve the risk.
Simply updating storefront software or plugins alone will not fix these PHP vulnerabilities. You will need confirmation from your hosting provider or developer that the PHP server has been fixed.
Which PHP versions have fixed these vulnerabilities?
PHP has stated that 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are the versions of PHP with the required fixes. Providers could supply equivalent fixes in their own supported packages, but ensure they have explicitly confirmed the fixes before assuming this is sufficient.
I’ve noticed something off, what should I do?
If you notice suspicious changes or unauthorised access, please contact your hosting provider or developer immediately.
Fixing these vulnerabilities neither confirms evidence of a compromise nor remove an existing compromise.