PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) - Webgility Online
This article helps Webgility Online application users understand two critical PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619) and what to do about them. They affect the web server that runs the Webgility store module, not Webgility itself. Users should ask their hosting provider or IT team to update PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, then restart the web server and PHP services. They should also change the passwords and keys stored on the server, including their store module credentials.
On October 21, 2026, two critical security vulnerabilities were disclosed in PHP, the software that runs many web servers and e-commerce platforms. If your online store is (or was) connected to Webgility through our store module, your store's web server runs PHP and should be updated.
• CVEs: CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 (critical).
• Affected versions: almost every PHP version from 5.4 onward.
• Risk: on a server that hasn't been updated, an attacker could run code without logging in and could expose passwords or keys the server handles.
• Status: attempts to exploit these vulnerabilities have been reported across the internet since the fix was released.
Who is affected: merchants whose store runs on a self-hosted or managed PHP server (for example, Magento/Adobe Commerce, WooCommerce, OpenCart, PrestaShop, X-Cart, Zen Cart, osCommerce, CS-Cart and similar) with the Webgility store module installed, now or in the past. Hosted platforms that don't use the store module (for example, Shopify, BigCommerce, Amazon, eBay) are not running the Webgility module on a server you manage.
Is this caused by Webgility?No. The issue is in PHP itself, at the server level. It affects PHP websites worldwide, regardless of which apps or integrations they use. Webgility's store module runs on PHP, which is why we're notifying connected merchants, but the module is not the source of the vulnerability.
Webgility does not manage or have access to your web server, so the update must be done by your hosting provider or IT team.
What to do now1. Contact your hosting provider or IT team today. Forward them the notification email from Webgility or a link to this article.
2. Update PHP to a fixed version and restart the web server and PHP services (for example, Apache/Nginx and PHP-FPM). The fix does not take effect until the services restart.
3. If your server runs PHP 8.1 or older, those versions no longer receive official updates. Ask about upgrading to a supported version, or about temporary protection such as a web application firewall (WAF).
4. After the update, rotate credentials. Change passwords and keys stored on the server, including your Webgility store module credentials.
|
PHP branch |
Fixed version (or later) |
|
8.5 |
8.5.12 |
|
8.4 |
8.4.27 |
|
8.3 |
8.3.36 |
|
8.2 |
8.2.35 |
|
8.1 and older |
No official fix — upgrade or add WAF protection |
• Official PHP website: php.net
• Google Cloud: Responding to core PHP vulnerabilities
A note on safety: Webgility will never ask for your passwords, payment details or server access by email. If a message claiming to be from us asks for any of these, contact our support team directly at support@webgility.com.