Legal
Security
Security advisories
PHP2Shell — CVE-2026-109618, CVE-2026-109619
Patched 21 October 2026 — the day PHP released the fixes. No customer action required.
Advisory published 24 October 2026
PHP published fixes for these vulnerabilities on 21 October 2026. StoreRocket's servers were running the patched release the same day.
We have found no evidence of compromise.
You do not need to reinstall StoreRocket, reconnect an integration, or rotate any credentials.
StoreRocket also sits behind Cloudflare, which deployed protections for these vulnerabilities before they were publicly disclosed.
Reporting a vulnerability
Email [email protected] with a reproducible proof of concept. We review every report that includes one.
We do not operate a bug bounty programme and do not offer monetary rewards. Automated scanner output is not reviewed.
Contact
Questions about this page, or a security review of StoreRocket, can be sent to [email protected]. Our Terms and Privacy Policy cover the rest.