Critical PHP Vulnerabilities: Eggflow Has Deployed the Fixes

Eggflow completed a production security patch on 22 October 2026 to address CVE-2026-109618 and CVE-2026-109619 in its PHP runtime. The patched PHP-FPM processes were verified on both production Front instances, and service readiness checks passed. No action is required inside Instant Traffic for this update.

If you also operate a separate PHP website or service, such as a WordPress site or a custom integration, check its patch status with your hosting provider. Eggflow’s deployment does not update software hosted in your own environment.

What PHP announced

On 21 October 2026, the PHP security team disclosed two critical vulnerabilities that can permit remote code execution without authentication. Its advisory covers PHP serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP identifies mod_php as the highest-risk deployment, with a demonstrated attack that can run before application code.

Read the official PHP security announcement

The two vulnerabilities, in plain language

CVE-2026-109618 concerns out-of-memory handling. When PHP stops a request while internal data is only partly initialized, request cleanup can encounter invalid state. The upstream advisory explains why this can lead to code execution. FPM’s startup behavior differs from mod_php, but that difference does not make an unpatched FPM installation safe.

PHP advisory: CVE-2026-109618 — RCE via OOM corruption

CVE-2026-109619 concerns stale state retained by a PHP worker. A later request handled by that worker can encounter references to memory released after an earlier request. Under vulnerable conditions, this use-after-free can lead to code execution.

PHP advisory: CVE-2026-109619 — RCE via stale global state

What Eggflow patched and verified

We applied the PHP project’s official source backport for these two CVEs to Eggflow’s production PHP runtime, built the patched runtime and deployed it on 22 October. We then checked the executables used by the running PHP-FPM workers, rather than relying only on an image tag or a command-line version string.

• Both production Front instances were running the patched PHP-FPM executables and reported ready.
• PHP extensions and the application’s Composer dependencies loaded successfully.
• The public application and readiness endpoints returned HTTP 200.
• The recorded release checks passed: 527 production application unit tests across 87 suites, five security regression cases on a separately compiled patched native PHP runtime, 12 UI unit tests and four release tests.

This was a targeted source backport, not an upgrade to PHP 8. The runtime continues to report PHP 7.4.33. PHP 7.4 remains end of life upstream; fixing these two CVEs does not provide general ongoing security coverage for that branch. A supported PHP branch remains the longer-term destination.

Official PHP source backport used for this patch

These deployment and test checks confirm the patch rollout within the scope checked. They are not a penetration test or a conclusion from a compromise investigation. This article is a security maintenance update and does not report a confirmed breach.

Which PHP releases contain the fixes?

The fixed upstream releases announced on 21 October are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Check the appropriate maintained branch or your operating-system vendor’s security notice. A vendor backport may retain an older-looking version number.

PHP 8.1 and older no longer receive normal PHP project updates. The project supplied minimal source backports for 7.4, 8.0 and 8.1 for this emergency. If you use an older branch, obtain a verified vendor or source fix for both CVEs and plan migration to a supported branch.

What merchants and administrators should do

1. Identify any PHP service you operate outside Shopify: a separate website, WordPress installation, custom application or integration.
2. Ask your host or administrator to confirm that both CVEs are fixed in the runtime actually handling web traffic. Check every serving instance, container image and PHP worker pool; a local CLI version alone is insufficient.
3. Deploy the fixed release or verified backport, then replace or restart all affected workers. Confirm that running processes use the patched binaries.
4. Check application readiness and important customer flows after deployment. Retain the package advisory or build record so the patch can be verified later.

For stores whose storefront is hosted by Shopify and that operate no separate PHP service, there is no PHP runtime for the merchant to update themselves for this advisory. No reinstall, setting change or manual patch is needed inside Instant Traffic.

If an update cannot happen immediately

PHP states that configuration mitigations are incomplete. They may reduce particular attack paths, but do not replace the fixes. Follow the upstream advisory with your administrator and prioritize patch deployment.

Questions about this update

For questions about Eggflow’s patch, contact the Eggflow support team through your app’s support channel. For a PHP website or service you host separately, ask its provider to confirm the deployed fix for both CVEs.

Published 22 October 2026. Vulnerability information is based on the PHP project’s announcement and linked advisories; Eggflow deployment details are based on our verified production release record.