Keeping your website secure is an essential part of maintaining a reliable online business. Following the announcement of two critical PHP security vulnerabilities on 21 October 2026, we can confirm that all Magento hosting servers we manage have been successfully patched to protect against the identified issues.
No action is required from our clients in relation to these server-side patches.
What were the PHP vulnerabilities?
The PHP development team disclosed two critical vulnerabilities that could potentially allow an attacker to execute malicious code remotely on affected PHP installations serving web requests.
- CVE-2026-109618 – remote code execution associated with out-of-memory state corruption.
- CVE-2026-109619 – remote code execution associated with stale global state being reused across requests.
Remote code execution vulnerabilities are particularly serious because, if successfully exploited, they can allow an attacker to run unauthorised code on a vulnerable server. This could put websites, applications and potentially their underlying hosting environments at risk.
Our Magento hosting servers have been patched
Following the security announcements, the necessary PHP security patches have been applied across all Magento hosting servers we manage.
These fixes are applied at server level, protecting the affected PHP environments without requiring clients to update their Magento installations or make changes to their website code specifically for these vulnerabilities.
All managed Magento hosting servers have been patched against CVE-2026-109618 and CVE-2026-109619.
Additional protection with Cloudflare
For websites using Cloudflare’s web application firewall (WAF), there is an additional layer of security between the public internet and the origin server.
Cloudflare’s security services can help identify and mitigate malicious traffic before it reaches your website, depending on the security rules and configuration in place.
This provides an additional layer of defence alongside the PHP security patches already applied to our servers.
It is important to understand that a web application firewall complements security updates rather than replacing them. Keeping the underlying software patched remains essential, even when a website benefits from additional perimeter protection.
What should Magento store owners do?
For clients hosted on our managed Magento hosting services, no immediate action is required for these two vulnerabilities. The relevant server-side patches have already been applied.
We continue to recommend the following security practices:
- Keep Magento, extensions and themes updated with supported security releases.
- Use a currently supported PHP version compatible with your Magento installation.
- Remove or disable extensions and functionality that are no longer required.
- Use a web application firewall, such as Cloudflare, where appropriate.
- Maintain regular backups and monitor your website for unusual activity.
Running an obsolete PHP version remains a security risk. Older versions may no longer receive security fixes from the PHP project, so upgrading to a supported version should be part of your ongoing maintenance plan.
Ongoing commitment to security
Security is an ongoing responsibility, not a one-off task. We monitor important platform security developments and apply relevant server-level fixes to help keep our clients’ Magento stores protected.
With the latest PHP patches applied across our managed Magento hosting servers, and additional Cloudflare protection available for sites using its firewall, we continue to take a layered approach to website security.
If you have any questions about your Magento hosting, PHP version or website security, please get in touch with Measured Designs.
Further information: Official PHP security announcement – 21 October 2026
