PHP Security Update (October 2026)
Topics covered on this page
PHP Security Update (October 2026)
On 21 October 2026, the PHP project released a security update that fixes two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619). Both vulnerabilities can allow an attacker to run code on a server remotely, without logging in. Attacks exploiting the vulnerabilities have been reported, so update PHP as soon as possible.
Note: The vulnerabilities are in PHP, not in the Omise libraries or plugins. Updating your store software or the Omise plugin does not fix them. The PHP installation on your server must be updated.
Who needs to act on the PHP security update
You need to act if you:
- Host your own PHP-based online store with an Omise plugin, such as WooCommerce, Magento, PrestaShop, OpenCart, or EC-CUBE.
- Use the Omise PHP library in your own application.
If you use a hosted checkout or redirect flow and do not run PHP yourself, no action is needed. Shopify merchants do not need to take any action.
Patched PHP versions
| PHP branch | Patched version | Supported by Omise |
|---|---|---|
| 8.5 | 8.5.12 or later | Not yet |
| 8.4 | 8.4.27 or later | Yes |
| 8.3 | 8.3.36 or later | Yes |
| 8.2 | 8.2.35 or later | Yes |
Omise PHP support: The Omise libraries and plugins currently support PHP 8.2 to 8.4. PHP 8.5 is not yet supported.
PHP 8.1 and earlier: No official patched release exists for PHP 8.1 and earlier. Move to a branch that Omise supports (PHP 8.2 to 8.4). Moving off an older branch can be a larger upgrade, particularly from PHP 7 or earlier, so allow time to test thoroughly. If you cannot upgrade straight away, ask your hosting provider what protection they offer, but upgrading is the lasting solution.
Check which PHP versions your platform supports
Some platform versions do not support the newest PHP versions. For example, some Magento versions do not support PHP 8.5. Use your platform's official requirements to confirm that your platform supports your PHP branch, then update to the newest patched version within that branch. If you need to move off PHP 8.1 or earlier, choose a branch that both your platform and Omise support:
- WooCommerce: Update PHP and WordPress
- Magento: Adobe Commerce system requirements
- PrestaShop: PrestaShop 9 PHP requirements
- EC-CUBE: EC-CUBE system requirements
- OpenCart: OpenCart system requirements
How to update PHP and verify your store
Update PHP to a patched version in your current branch
Update PHP to the newest patched version within the branch you already run. For example, if you run PHP 8.2.x, update to 8.2.35 or later in the 8.2 branch. You do not need to move to a newer PHP branch, such as from 8.2 to 8.4. PHP runs on your own server, so your hosting provider or developer needs to make the change.
Restart PHP-FPM or the web server
After the upgrade, restart PHP-FPM or your web server so that the new PHP version is loaded.
Confirm the PHP version your website uses
Run the following command to see a PHP version on the command line:
php -v
Your website may use a different PHP version from the command line, so ask your hosting provider to confirm the version your site runs on.
Test your store after the PHP upgrade
Upgrading PHP can affect plugins, themes, and custom code. Before returning to normal operation, confirm that payments still work. Use Omise test mode where possible, and test at least the following:
- A complete checkout with each payment method you offer, for example cards (including 3D Secure, if you use it) and any other payment methods
- Order status updates correctly after payment
- A refund, if you offer refunds
- No new errors in your server's PHP error log
You may see deprecation warnings in your PHP logs after the upgrade. Deprecation warnings are usually not errors, but if anything stops working, see Get help after upgrading PHP.
Omise library and plugin versions
Omise does not currently expect you to need to update the Omise library or plugin if you use PHP 8.2 to 8.4. The minimum required library and plugin versions are listed on Library Updates Required.
Get help after upgrading PHP
If something stops working after you upgrade PHP, contact Omise support and include:
- Your Omise plugin or library version
- Your PHP version
- The error message
FAQ
Q: Are the Omise libraries or plugins vulnerable?
A: No. Both vulnerabilities are in PHP itself. Updating your store software or the Omise plugin does not fix them; only updating PHP on your server does.
Q: I use a hosted checkout or redirect flow, or I sell on Shopify. Do I need to do anything?
A: No. If you do not run PHP on your own server, no action is needed.
Q: Do I need to move to a newer PHP branch, such as from 8.2 to 8.4?
A: No. Update to the newest patched version within the branch you already run, for example from PHP 8.2.x to 8.2.35 or later. The exception is PHP 8.1 and earlier, which have no official patched release, so you need to move to a branch that Omise supports (PHP 8.2 to 8.4).
Q: Can Omise update PHP for me?
A: No. Your hosting provider or developer must upgrade PHP on your server.
Q: How do I check which PHP version my website uses?
A: Running php -v shows a PHP version on the command line, but your website may use a different one. Ask your hosting provider to confirm the version your site runs on.
Q: I see deprecation warnings in my PHP logs after upgrading. Is something wrong?
A: Deprecation warnings are usually not errors. If payments, order updates, or refunds stop working, contact Omise support with your plugin or library version, your PHP version, and the error message.
Q: Do I need to update the Omise library or plugin?
A: Omise does not currently expect so if you use PHP 8.2 to 8.4.
Q: Does Omise support PHP 8.5?
A: Not yet. The Omise libraries and plugins currently support PHP 8.2 to 8.4.
Q: Do I need to test my store after upgrading PHP?
A: Yes. A PHP upgrade can affect plugins, themes, and custom code. Run a complete checkout, confirm that order statuses update, test a refund if you offer refunds, and check your PHP error log for new errors.
