Important Security Notice: Critical PHP Vulnerabilities (October 2026)

[Basara]

Hello AbanteCart Community,

We are aware of the recently reported critical PHP security vulnerabilities CVE-2026-109618 and CVE-2026-109619, which may allow attackers to execute malicious code on affected servers.

We would like to clarify that these vulnerabilities are related to PHP itself, not AbanteCart.

PHP is the programming language used by AbanteCart and many other web applications. While these issues are not caused by AbanteCart, stores running on vulnerable PHP installations may still be exposed to security risks.

What should AbanteCart merchants do?

1. Contact your hosting provider or server administrator immediately.

Ask them to verify whether your server is affected by these vulnerabilities and ensure that all necessary PHP security patches have been applied.

2. Follow official PHP security recommendations.

Refer to the official PHP website for security announcements, affected versions, and recommended updates: https://www.php.net/

3. Keep your hosting environment and AbanteCart updated.

Make sure your server is running a secure, supported PHP version that is compatible with your AbanteCart installation. We also recommend keeping AbanteCart and installed extensions up to date.

Important to understand

Updating or reinstalling AbanteCart will not fix vulnerabilities in the PHP engine. These issues must be addressed at the server level by your hosting provider or server administrator.

We strongly encourage all AbanteCart merchants to take this matter seriously and ensure their hosting environments are properly secured.

Thank you for your attention and for being part of the AbanteCart community.

AbanteCart Team