PHP security issue affecting PrestaShop: fixes for CVE-2026-109618 and CVE-2026-109619
Last updated:
Two critical vulnerabilities in PHP can also put PrestaShop stores at risk. The fix is to update PHP on the server. If you use shared hosting or a managed VPS, contact your provider. If you manage your own VPS or dedicated server, I can help apply the fix.
PHP security issue affecting PrestaShop: how to check whether you are affected
You can find the PHP version used by your store in the PrestaShop back office under Advanced Parameters → Information. Checking the version is only a first step: some Linux distributions backport security fixes to their packages, so the PHP version number shown there may not tell you by itself whether the server is patched. What matters is whether your provider or server administrator has installed the fixed package. PrestaShop’s guidance
The patched versions released by the PHP project are:
PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12
If you use another PHP version, contact your hosting provider or server administrator to check whether a security fix is available for it.
PHP security issue affecting PrestaShop: what to do
Do you use shared hosting or a managed VPS?
Contact your hosting provider. Ask them to check that the PHP version used by your store has been patched against CVE-2026-109618 and CVE-2026-109619. Ask them to confirm that the fixed version or package is installed and active.
Do you manage your own VPS or dedicated server?
If you administer the server yourself, install the patched PHP package for your Linux distribution and restart the relevant PHP processes or services. If the store runs in Docker, update the base image and deploy it again.
If you are unsure how to update PHP safely, I can help. I can check the server, apply the required fix and make sure PrestaShop is working properly afterwards. Get in touch if you need help with your VPS or dedicated server.
Frequently asked questions
Is CVE-2026-109618 a PrestaShop vulnerability?
No. It is a vulnerability in PHP, which PrestaShop uses. The fix therefore needs to be applied on the server.
Is updating PrestaShop enough?
No. Update PHP or confirm with your provider that a security fix has been installed for the PHP version used by your store.
Where can I get help fixing PHP for PrestaShop?
If you use shared hosting or a managed VPS, ask your hosting provider to apply the fix. If you manage your own VPS or dedicated server, you can contact me for help.
More articles
Three new nalezny.cz modules for articles, variants and digital sales
Three new PrestaShop modules have joined nalezny.cz: Simple CMS for articles, Variant Extra Description for combination-specific text, and Virtual Combinations for digital products with variants. Here is how they work, where they fit together, and what to check in your theme and multistore setup.
Continue readingMoving to PrestaShop 9: benefits and points to consider
Moving to PrestaShop 9 can modernize your store, but the result depends on the migration. Outdated modules, custom changes and an incompatible theme can cause downtime or security issues. This guide covers the new features, the checks to make before upgrading and why testing, backups and an experienced developer matter.
Continue readingWho will pay for PrestaShop’s open-source development?
PrestaShop changed ownership in February 2026, when cyber_Pixel acquired the company. New CEO Mikołaj Król says around 60% of revenue comes through official partners and about a third from Marketplace purchases, and encourages merchants to use official services to support development. The community sees both a way to fund the product and questions about commercial influence, transparency and the future of open source.
Continue readingPrestaShop 9.2: a shorter path to purchase, custom fields and AI in the back office
PrestaShop 9.2 adds three features for checkout and store management: an optional one-page checkout, Extra Properties for custom fields, and Ask AI. The checkout may reduce steps, but its benefit depends on the theme and payment and delivery modules. Extra Properties supports selected entities and placements. Ask AI needs an external provider and API key and asks for approval before making changes. Test compatibility before upgrading.
Continue reading