Security Status: The PHP2Shell Vulnerability (CVE-2026-109618 / 109619)

On October 21, 2026 the PHP project disclosed two critical security flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 and, under the right conditions, let an attacker run code on a server without logging in. This affects PHP itself, which powers a large share of the internet, so it's a broad, internet-wide event, not something specific to Kiva Logic. Here's where your store stands.

The short version

Your store is protected and there's nothing you need to do. We moved on this the day it was announced and we're watching the situation as it develops.

What the flaw is

The exploit works by sending a specially malformed file upload (a "multipart" request) that confuses PHP's memory handling and its upload-progress feature. A patched version of PHP (8.3.36 and the matching releases on other branches) shipped the same day the flaw went public.

How your store is protected

• The front door is already filtered. Nearly every Kiva Logic store sits behind Cloudflare, an enterprise security layer at the edge of the internet. Its firewall inspects traffic before it ever reaches your store and blocks the malformed upload requests this exploit depends on. That shield was in place before this flaw existed.
• The few stores that route around that layer got a direct block. A small number of stores point their domain straight at the hosting server instead of through Cloudflare. For those, a server-level rule was added that rejects the exact type of upload request the exploit needs, while leaving normal checkout, login, and file uploads working. That block went live on October 21.
• We are tracking the underlying patch. Our hosting providers are rolling out the fixed version of PHP across their platforms. As each server is updated, it's protected at the source and the temporary blocks become unnecessary.

What's happening next

We're monitoring our hosting providers' patch rollout and our own traffic for any sign of exploit attempts. Once a server is confirmed running the patched PHP, the temporary upload block is removed from it so everything returns to normal. We'll update this post if anything changes.

Do you need to do anything?

No. Your store, your customers, and your data are protected by the layers above.

Sources: the official CVE-2026-109618 and CVE-2026-109619 records, and the PHP project's 8.3.36 security release.