{"id":3622,"date":"2026-10-22T18:04:03","date_gmt":"2026-10-22T10:04:03","guid":{"rendered":"https:\/\/www.hitsteps.com\/blog\/php-security-update-october-2026\/"},"modified":"2026-10-22T18:04:03","modified_gmt":"2026-10-22T10:04:03","slug":"php-security-update-october-2026","status":"publish","type":"post","link":"https:\/\/www.hitsteps.com\/blog\/php-security-update-october-2026\/","title":{"rendered":"Security update: PHP vulnerabilities disclosed on 21 October 2026"},"content":{"rendered":"<p>Hitsteps uses PHP as one of the components in our infrastructure. Following the PHP project&#8217;s disclosure of <strong>CVE-2026-109618<\/strong> and <strong>CVE-2026-109619<\/strong> on 21 October 2026, we deployed the fixes to our affected Hitsteps services <strong>within hours of the disclosure<\/strong>.<\/p>\n<p>The patched services include our main application, tracking, website-thumbnail processing and WordPress blog, together with the related application workers and scheduled workloads.<\/p>\n<p>We verified the patched runtimes after deployment, including the binaries used by running services. This goes beyond checking a version label or confirming that an update was downloaded.<\/p>\n<h2>Do Shopify merchants or other Hitsteps customers need to update anything?<\/h2>\n<p>The fixes are applied on our servers. You do not need to reinstall the Hitsteps Shopify app or replace your Hitsteps tracking code to receive these server-side fixes.<\/p>\n<h2>Conducting a third-party security review?<\/h2>\n<p>If you need technical confirmation for a vendor assessment, please contact <strong>sales@hitsteps.com<\/strong> and identify the Hitsteps integration you use. We can provide the verified remediation details relevant to your review.<\/p>\n<p>This notice confirms the deployment of fixes for these two vulnerabilities. It does not make a determination about historical exploitation or customer-data exposure. We will communicate verified customer impact if identified.<\/p>\n<p>For background, see the <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\">PHP project&#8217;s security advisory<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hitsteps deployed fixes for CVE-2026-109618 and CVE-2026-109619 within hours of the PHP security disclosure on 21 October 2026. The server-side fixes require no store-side update.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3622","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/posts\/3622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/comments?post=3622"}],"version-history":[{"count":0,"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/posts\/3622\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/media?parent=3622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/categories?post=3622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hitsteps.com\/blog\/wp-json\/wp\/v2\/tags?post=3622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}