PHP Security Updates for Your Online Store
PHP Security Updates for Your Online Store
Two critical security vulnerabilities were recently disclosed in PHP, a technology used to run many websites. What you need to do depends on who hosts your store.
If your store is hosted by Square Online or Weebly
We’ve applied security updates to the servers that host your store to address both vulnerabilities. You don't need to update PHP or take any action to address these vulnerabilities for the store we host. If you also operate a separately hosted website or store, follow the guidance below for that site.
If your store is independently hosted
If you use Square with an independently hostedWooCommerce, Magento/Adobe Commerce, OpenCart or PrestaShopstore, contact your hosting provider or developer now. Ask them to confirm that the PHP software running your store includes the fixes for two critical security vulnerabilities.
What is the issue?
PHP is software that runs many online stores. Two new vulnerabilities in PHP could let an attacker without a login run code on an affected server. A compromised store could expose customer information, change checkout, or interrupt sales.
These vulnerabilities are in PHP itself. This advisory does not identify a flaw in the Square plugin or confirm that your store has been compromised.
What should I do if my store is independently hosted?
Contact your hosting provider or developer now, even if they manage updates for you.
Ask them to confirm that the PHP environment serving your store has fixes for both CVE-2026-109618 and CVE-2026-109619. If not, ask them to apply the fixes immediately using the current PHP or hosting-provider guidance.
If your store uses an older PHP release or your provider cannot update promptly, ask them for a safe remediation plan and escalate to your technical support contact. Do not assume that a temporary workaround fully resolves the risk.
Updating the Square plugin or storefront software alone will not fix these PHP vulnerabilities. Your hosting provider or developer needs to address the PHP server software.
Which PHP versions contain the fixes?
The PHP project’s advisory lists PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as fixed releases for their respective branches. Your provider may supply equivalent fixes in its own supported packages. Ask your provider to confirm coverage for both vulnerabilities rather than relying on the version number alone.
Has my store been compromised?
This advisory describes potential exposure. Receiving or reading it does not mean that your store has been compromised. If you suspect unauthorized changes or access, contact your hosting provider or developer immediately. A PHP update addresses these vulnerabilities; it does not by itself establish whether a store was previously compromised or remove an existing compromise.
Where can I get help?
Your hosting provider or developer can confirm your PHP patch status and make the server update. For questions about your Square integration, use the established Square support channel.