# Critical PHP vulnerabilities on October 21, 2026: what CS-Cart owners should do

Author: Anton Larionov

Published: 2026-10-21

On October 21, 2026, the PHP team released fixes for critical vulnerabilities that, under certain conditions, allow code to run on a server without authentication. Check the PHP version serving your CS-Cart store soon, and install a patched release that the store supports.

**Free store security check** — We’ll check whether these PHP vulnerabilities affect your store and assess its readiness for a fix. [Request a free check](https://larionov.tech/en/blog/php-security-update-cs-cart-october-2026#contact).

Do not change your PHP version until you have checked that your CS-Cart version and installed add-ons support it. Otherwise, the store or individual features may stop working.

## What happened, and how serious is it?

Two serious PHP flaws — **CVE-2026-109618** and **CVE-2026-109619** — can, under certain conditions, let an attacker run code on a server without signing in to the store. Fixes are available now. [PHP announcement](https://www.php.net/archive/2026.php).

For a store owner, the main concern is access to data and files available to the PHP process.

## Which CS-Cart versions support PHP 8?

PHP has released patched versions for supported branches starting with 8.2. For PHP 7.4, 8.0 and 8.1, vendors may backport the fixes to the older branch. That means a CS-Cart upgrade is not required to address these two CVEs specifically if your host confirms that a package fixing both is installed.

| PHP branch | Supported starting with CS-Cart / Multi-Vendor |
| --- | --- |
| PHP 7.4 | 4.12.1 |
| PHP 8.0 | 4.15.1 |
| PHP 8.1 | 4.17.1 |
| PHP 8.2 | 4.18.1 |
| PHP 8.3 | 4.19.1 |

If you later move to PHP 8.2, you need at least **CS-Cart or Multi-Vendor 4.18.1**. Test your theme, add-ons, extensions and custom code on a staging copy before changing PHP versions. [CS-Cart system requirements](https://docs.cs-cart.com/latest/install/system_requirements.html).

## What if your store still runs PHP 7.4, 8.0 or 8.1?

These branches have reached the end of their normal upstream support. Moving from PHP 7.4 to PHP 8.0 alone will not put a store back on a supported branch. [PHP end-of-life information](https://www.php.net/eol.php).

For this incident, the PHP security team has provided minimal source backports for PHP 7.4, 8.0 and 8.1. Distributions and vendors offering extended support may also supply patched packages. That does not mean your hosting provider has installed them, and it does not restart normal support for the older branches. [PHP's backport announcement](https://www.php.net/archive/2026.php).

If your host confirms that the installed PHP package fixes **both** CVEs and has restarted its workers, this incident does not require an immediate CS-Cart upgrade or a change of PHP branch. The older PHP branch still lacks normal upstream support, so plan a separate move to a supported version. If no verified patch is available, urgently arrange an update and discuss temporary restrictions on public access with your administrator.

## An action plan for CS-Cart store owners

### 1. Check your current CS-Cart and PHP versions

If you use **CS-Cart 4.18.1 or later** and have a patched **PHP 8.2.35 or later release in the 8.2 branch** installed, these two vulnerabilities do not require urgent action. The version number 8.2 or 8.3 alone does not mean the fixes are installed.

If your PHP version is 8.1 or older, or the fix for the installed PHP has not been confirmed, continue reading this article.

### 2. Check the patch status on your server

On shared hosting, ask your provider to confirm that both CVE-2026-109618 and CVE-2026-109619 are fixed in the PHP serving your website.

If you administer your own VPS, install a patched PHP package from a trusted repository or ask your system administrator to do it. Check the vendor advisory for fixes to both CVEs, restart the PHP processes serving the site, and confirm that the store uses the updated package. Command-line PHP may be a different version from the web runtime.

If the installed package contains verified fixes for an older PHP branch, you do not need an immediate PHP or CS-Cart upgrade solely for these CVEs. Plan a separate move to a supported branch. If no fix is installed and you cannot obtain one, continue to the next step.

### 3. Check whether your CS-Cart version supports newer PHP

Moving to PHP 8.2 requires at least **CS-Cart 4.18.1**. If your CS-Cart version meets that requirement but the store runs PHP 8.1 or older without a verified fix, I recommend moving to a patched PHP 8.2 release soon. Check add-on and custom code compatibility before switching.

### 4. Update CS-Cart

If your CS-Cart version is older than 4.18.1, do not move directly to PHP 8.2: that could cause errors and instability. Plan a CS-Cart upgrade first.

Check whether your CS-Cart license includes updates. If updates are unavailable, consider [renewing update access](https://larionov.tech/produkty/updates).

Then test the upgrade and add-ons on a staging copy before applying the changes to the live store.

### 5. Update PHP

After confirming compatibility, install a patched PHP release: **8.2.35 or later in the 8.2 branch**, or **8.3.36 or later in the 8.3 branch** if your CS-Cart version supports it. Then test the storefront, checkout and integrations.

## Help with your CS-Cart and PHP update

Larionov.tech can review your store's environment, prepare a CS-Cart upgrade on a staging copy and identify add-ons or customisations that need adaptation. After the move, we check storefront behaviour, checkout and integrations.

[Discuss your CS-Cart upgrade](https://larionov.tech/en/services/cs-cart-update).

Send your store URL, CS-Cart version, PHP version if known, and your hosting provider's response about the two CVEs. These details help us plan the immediate fixes and the scope of the upgrade.