Summary: Smart Wishlist and Smart RSS Feed apps now run on servers with PHP 8.5.12, which fixes both CVE-2026-109618 and CVE-2026-109619 vulnerabilities. We found no evidence that merchant data or Shopify access tokens were exposed. Merchants don’t need to do anything. Their data is safe and their store is secure.
What happened?
On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both could let an attacker run code on a vulnerable server without logging in. Security vendors reported that working proof-of-concept exploits existed, so we treated this as urgent from the first hour.
Why it mattered?
Part of the Smart Wishlist backend runs on PHP. Some of our servers were running older PHP releases that had reached end of life. Those versions don’t receive security fixes, so waiting for a patch was never an option for them.
Our setup gave us some protection. We run PHP through PHP-FPM instead of embedding it inside the web server, and PHP’s own advisory describes that as less exposed to the simplest attack path. But the advisory also shows that FPM is not immune, so we didn’t treat it as a reason to wait.
What we did?
1. Within hours, we applied settings that closed the attack routes described in the advisories. These included turning off the PHP feature involved in demonstrated method of one of the attacks, blocking the kind of web requests used to trigger the other, and tightening request limits. These steps were meant to buy us time, not to be the final answer.
2 Because some of our servers ran versions that will never be fixed, we moved the application to new servers running PHP 8.5.12, the release that contains the fix for both vulnerabilities. Moving a large number of servers and application modules to a much newer PHP version meant fixing compatibility issues along the way, which took more time than a simple patch. We chose that over leaving unfixable software online.
Was any data exposed?
No. We reviewed server logs and files from the affected servers, including the retained snapshots, for signs of crashes, unexpected files, unusual scheduled jobs and unauthorised access. We found no evidence of unauthorised access, and no indication that merchant data or Shopify API access tokens were exposed. We will update this post if that changes.
What merchants need to do?
Nothing. Smart Wishlist runs on our secure infrastructure, so there is nothing to update in your store and no need to re-authorise the app.
What we’re changing going forward?
- We are removing end-of-life software from our infrastructure, so the next security release doesn’t catch us with versions that can’t be patched.
- We are adding tracking of security advisories for every component we run, with a defined response time.
- We will keep PHP and the web server on supported releases.
If you have questions, our support team is happy to help at support@webmarked.net
References: PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.