Hitsteps uses PHP as one of the components in our infrastructure. Following the PHP project’s disclosure of CVE-2026-109618 and CVE-2026-109619 on 21 October 2026, we deployed the fixes to our affected Hitsteps services within hours of the disclosure.
The patched services include our main application, tracking, website-thumbnail processing and WordPress blog, together with the related application workers and scheduled workloads.
We verified the patched runtimes after deployment, including the binaries used by running services. This goes beyond checking a version label or confirming that an update was downloaded.
Do Shopify merchants or other Hitsteps customers need to update anything?
The fixes are applied on our servers. You do not need to reinstall the Hitsteps Shopify app or replace your Hitsteps tracking code to receive these server-side fixes.
Conducting a third-party security review?
If you need technical confirmation for a vendor assessment, please contact sales@hitsteps.com and identify the Hitsteps integration you use. We can provide the verified remediation details relevant to your review.
This notice confirms the deployment of fixes for these two vulnerabilities. It does not make a determination about historical exploitation or customer-data exposure. We will communicate verified customer impact if identified.
For background, see the PHP project’s security advisory.
