Resolved on October 22, 2026, affecting API and Checkout & Other Widgets and 1 more.
On October 20, 2026, details of two critical vulnerabilities in PHP, known as PHP2shell, were made public. These vulnerabilities could allow an attacker to run code remotely on affected systems. Further information is available in the PHP security announcement (https://www.php.net/archive/2026.php#2026-10-20-1) Our engineering team responded quickly and applied the patches to all our systems as soon as the patches were released. Our services kept running normally throughout, with no downtime or impact for our customers. We also reviewed our traffic for the whole of October 2026 and found no evidence of suspicious activity or misuse linked to these vulnerabilities. We’ll keep monitoring and will post here if anything changes. We recommend that you also check whether your own systems or third-party services use PHP, and apply the latest security updates from PHP and your software providers.
Affected components
Update timeline
- resolved Oct 22, 2026, 11:14 AM UTC
On October 20, 2026, details of two critical vulnerabilities in PHP, known as PHP2shell, were made public. These vulnerabilities could allow an attacker to run code remotely on affected systems. Further information is available in the PHP security announcement (https://www.php.net/archive/2026.php#2026-10-20-1) Our engineering team responded quickly and applied the patches to all our systems as soon as the patches were released. Our services kept running normally throughout, with no downtime or impact for our customers. We also reviewed our traffic for the whole of October 2026 and found no evidence of suspicious activity or misuse linked to these vulnerabilities. We’ll keep monitoring and will post here if anything changes. We recommend that you also check whether your own systems or third-party services use PHP, and apply the latest security updates from PHP and your software providers.
Your product runs on more than Cleeng
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services