PHP Security Update (October 2026)
Topics covered on this page
On 21 October 2026, the PHP project released a security update that fixes two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619). Both vulnerabilities allow unauthenticated remote code execution, meaning an attacker can run code on your server without logging in. Attacks exploiting the vulnerabilities have been reported, so update PHP as soon as possible.
Note: The vulnerabilities are in PHP, not in the Omise libraries or plugins.
Who needs to act on the PHP security update
You need to act if you:
- Host your own PHP-based online store with an Omise plugin, such as WooCommerce, Magento, PrestaShop, OpenCart, or EC-CUBE.
- Use the Omise PHP library in your own application.
If you use a hosted checkout or redirect flow and do not run PHP yourself, no action is needed.
Patched PHP versions
| PHP branch | Patched version |
|---|---|
| 8.5 | 8.5.12 or later |
| 8.4 | 8.4.27 or later |
| 8.3 | 8.3.36 or later |
| 8.2 | 8.2.35 or later |
PHP 8.1 and earlier: The PHP project no longer releases security fixes for PHP 8.1 and earlier, so no official patched version exists for these branches. Upgrade to a supported branch (8.2 or later). Some hosting providers apply their own fixes to older versions, so check with your provider, but upgrading is the safest option.
How to update PHP and verify your store
Update PHP to a patched version
Omise cannot update PHP on your server. Ask your hosting provider or developer to upgrade PHP to a patched version listed in the preceding table.
Restart PHP-FPM or the web server
After the upgrade, restart PHP-FPM or your web server so that the new PHP version is loaded.
Confirm the PHP version your website uses
Run the following command to see the PHP version on the command line:
php -v
The command-line version can differ from the version that serves your website, so ask your hosting provider to confirm the PHP version your site runs on.
Test your store after the PHP upgrade
Upgrading PHP can affect plugins, themes, and custom code. Before returning to normal operation, confirm that payments still work. Use Omise test mode where possible, and test at least the following:
- A complete checkout with each payment method you offer, for example, cards (including 3D Secure, if you use it) and any other payment methods
- Order status updates correctly after payment
- A refund, if you offer refunds
- No new errors in your server's PHP error log
Omise library and plugin versions
You do not need to update the Omise library or plugin because of the PHP security update. The minimum required library and plugin versions are unchanged and are listed on Library Updates Required.
Get help after upgrading PHP
If something stops working after you upgrade PHP, contact Omise support and include:
- Your Omise plugin or library version
- Your PHP version
- The error message
FAQ
Q: Are the Omise libraries or plugins vulnerable?
A: No. Both vulnerabilities are in PHP itself. Updating PHP fixes the issue, and you don't need to update any Omise libraries or plugins.
Q: I use a hosted checkout or redirect flow. Do I need to do anything?
A: No. If you don't run PHP on your own server, you don't need to do anything.
Q: Can Omise update PHP for me?
A: No. Your hosting provider or developer must upgrade PHP on your server.
Q: How do I check which PHP version my website uses?
A: Running php -v shows the command-line version, which can differ from the version that serves your website. Ask your hosting provider to confirm the version your site runs on.
Q: My server runs PHP 8.1 or earlier. What should I do?
A: Upgrade to PHP 8.2 or later. The PHP project no longer releases security fixes for PHP 8.1 or earlier, so no official patched versions exist for these branches.
Q: Do I need to test my store after upgrading PHP?
A: Yes. A PHP upgrade can affect plugins, themes, and custom code. Run a complete checkout, confirm that order statuses update, test a refund if you offer refunds, and check your PHP error log for new errors.
