PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 (PHP2Shell)
security update
Merchant and affiliate panel
Processing tracking requests
Sending emails
Patched in 3 hours and 58 minutes
disclosed
Fix released upstream
monitoring
T+0:15
Attack monitoring live
mitigation
–
Mitigation in place
patching
T+0:15
Rollout started
patched
T+3:58
All systems patched
Patch progress by system
CRM & My Account
Helper apps
PostAffiliatePro
Awaiting patch
Mitigation in place
Patched
disclosed
Patched PHP versions fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) were released.
· T+0:00
monitoring
We analysed the vulnerabilities and started monitoring our infrastructure for attack attempts.
· T+0:15
patching
We started building our own images with the fixed PHP release instead of waiting for the official ones.
· T+0:15
patching
CRM, which serves My Account, is patched.
· T+1:45
patching
All helper apps are patched.
· T+2:00
patched
PostAffiliatePro is patched. All systems now run the fixed PHP release. There was no downtime and no indication of exploitation. No customer action is required.
· T+3:58