Critical PHP Vulnerabilities: How to Protect Your CS-Cart Store
Critical PHP vulnerabilities: protect your store
Two critical vulnerabilities have been discovered in PHP, the technology that powers CS-Cart. Under certain conditions, they allow an attacker to execute code remotely on the server without authentication. For your store, this could mean access to data, changes to website files and disruption of its operation.
Fixes have already been released. We recommend updating PHP without delay and preparing your store for the upgrade.
What happened
On 21 October 2026, the PHP developers released emergency updates addressing CVE-2026-109618 and CVE-2026-109619.
The issue is in PHP itself. The fixes must therefore be installed on the server hosting your store.
Which version to install
The fixes are included in the following versions:
| PHP branch | Fixed version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Choose a version compatible with your version of CS-Cart, your theme and installed add-ons.
If your store runs on PHP 8.1 or earlier, contact your hosting provider to check whether fixes are available for your build or whether you can move to a supported PHP branch.
Our add-ons are ready
The latest versions of all our CS-Cart add-ons have already been adapted to the updated PHP versions.
Install the available add-on updates when preparing your store for the upgrade. Check the compatibility of CS-Cart itself, your theme and third-party add-ons separately.
Updating add-ons ensures PHP compatibility. To fix the vulnerabilities themselves, PHP must be updated on the server.
What store owners should do
- Contact your hosting provider or system administrator. Ask whether the PHP package installed includes fixes for these vulnerabilities.
- Create a backup of your store files and database.
- Check compatibility of CS-Cart, your theme and add-ons with the chosen PHP version. When switching PHP branches, test the upgrade on a staging copy first.
- Update our add-ons and PHP in the order agreed with your specialist.
- Check your store: catalog, cart, checkout, payments and administration panel.
Protect your store and customer data. PHP fixes are available, and our add-ons are ready for the upgrade.
