On October 21, 2026, the PHP Project released security updates for two critical vulnerabilities in the PHP programming language, which are currently being widely reported in the media. At XONIC Hosting, we first implemented a protective measure on all servers on October 21 and installed the updates that same day. Customers with online stores hosted by XONIC Hosting do not need to take any action.
At a Glance
- What happened? Two critical security vulnerabilities were discovered in PHP itself (CVE-2026-109618 and CVE-2026-109619, often referred to as “PHP2Shell” in reports). PHP, which serves as the foundation for many websites, is affected; the XONIC Shop System is not.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on October 21, 2026.
- On XONIC Hosting: The protective measure has been active on all servers since the afternoon of October 21. The updates for PHP 8.2 through 8.5 were installed in the early evening.
- Your effort: None, if your store runs on XONIC Hosting.
- Ifyour store is hosted by another provider: Ask your host about the update. Please coordinate any change to the PHP version with us beforehand.
As of: October 21, 2026, 7:30 p.m.
What is known about the security vulnerabilities?
The PHP security team classifies both vulnerabilities as critical. They affect PHP installations that respond to requests from the internet, regardless of what software is running on them. Therefore, a plugin, theme, or store update cannot fix them; only an update to PHP on the server will do so. Security services have already reported the first attempted attacks.
The release was originally scheduled for Thursday, October 22. Because details were leaked in advance, the PHP team moved up the updates.
What have we done at XONIC Hosting?
| Timeline | Action |
|---|---|
| October 20, 2026, evening | The PHP team announced the security updates for October 21. |
| October 21, 2026, afternoon | We identify all PHP versions on our servers, implement the recommended security measures for each one, and verify that the online stores continue to run normally. The PHP project releases the patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. |
| October 21, 2026, early evening | The updates have been deployed on all servers in the XONIC hosting environment. We then checked each version and the availability of the online stores. |
What’s changing in the XONIC Shop System?
No store update is necessary to close these vulnerabilities, as they are in PHP. Additionally, we have enhanced session security in the store: Starting with version 4.9.176, the store will only accept sessions that it has opened itself. This will be included in the next update. This setting is already active on our servers.
What about stores running older PHP versions?
The PHP project no longer releases updates for PHP 8.1 and older versions. The security measure is also enabled on XONIC hosting for these versions. However, according to the PHP team, the vulnerabilities can only be fully patched by using a current version of PHP.
We recommend PHP 8.4, as the current shop version is designed for this. Older shop versions require an update before the switch; otherwise, the shop will no longer be accessible afterward. If your shop is still running on an older version, please contact us. We’ll plan the transition together with you.
Frequently Asked Questions About the PHP Security Vulnerabilities
Is the XONIC Shop System affected by the PHP security vulnerabilities?
The vulnerabilities are in PHP, the programming language on which most online stores and websites run, not in the XONIC Shop System. They are fixed by a PHP update on the server. This update has been installed on XONIC Hosting since October 21, 2026.
As a customer of XONIC Hosting, do I need to do anything?
No. We installed the security patch and PHP updates on all XONIC Hosting servers on October 21, 2026, and then tested them. If your store is still running on PHP 8.1 or older, we also recommend upgrading to PHP 8.4.
My store is hosted by a different provider. What should I do?
Your hosting provider is responsible for the server and PHP version. Ask them if they have installed the updates from October 21, 2026. If they change the PHP version in the process, please coordinate the change with us beforehand, as older shop versions will only run on PHP 8.4 after an update.
Which PHP versions include the fix?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, all dated October 21, 2026. The PHP project no longer provides updates for PHP 8.1 and older versions.
My store is still running on PHP 8.1 or older. Is that a problem?
There are no longer any official fixes available for these versions. XONIC Hosting has implemented a protective measure, but only an up-to-date PHP version provides complete protection. We recommend PHP 8.4. Older store versions will first need an update for this, which we’d be happy to plan with you.
Do I need a store update?
Not to close the security gaps, since the PHP update takes care of that. Starting with version 4.9.176, the store additionally protects its own sessions. In XONIC Hosting, this setting is already active at the server level; the store version also applies it to stores hosted by other providers.
Questions about your store?
Would you like to know which PHP version your store is running on, or are you planning to migrate to PHP 8.4? Open a support ticket or use our contact form.
Sources & Further Information
Stephan Dunger
Stephan Dunger is one of the brains behind the XONIC store system. He has been developing the platform together with the team since 2012 - from the database to the interfaces to the checkout.
A passionate programmer, technical mind and consultant at the same time: with his in-depth knowledge of store systems and e-commerce, Stephan combines the depth of a developer with an eye for the big picture. Together with the XONIC team, he shapes the technical direction, consistently thinks about functions from the retailer's perspective and advises on customized solutions.
The result is software with a face: customers don't get an anonymous provider, but a direct line to the people who develop XONIC. Pragmatic, fast and at eye level.
