Hi,
On Wednesday, 21 October 2026 the PHP project published security updates for two critical flaws: CVE-2026-109618 and CVE-2026-109619. On an affected PHP server they can be used to run code without anyone being signed in. In public the pair is called php2shell.
The patches for the PHP version we run were out the same day. From about 16:30 CEST we installed them. The shop has been on the updated version since then.
What we updated
This is the PHP runtime the shop runs on. Updating only the application code would not close these flaws. That is why we replaced the runtime itself, not a plugin and not a template.
We are not writing down how a request triggers the flaw. That kind of detail helps the next attempt, and it does not help you.
What this means for you
- You do not need to do anything. No new account, and no extra step at checkout because of this update.
- The update does not change orders or accounts. It does not reset an order and it does not move a balance.
- If a single page misbehaves, open a support ticket and include the order number and the time.
Your Remicals.de Team