On 21 October 2026 the PHP project released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. They fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, which PHP says can allow remote code execution without signing in. They're in PHP, the language your server runs the store with, so they affect PHP sites of every kind. PHP's advice is short: there are no complete mitigations, and updating is the only safe choice.
Is this a PrizeX bug?
No. The flaws are in PHP, not in PrizeX, BidKing or RaffKing, and no store update fixes them. Your store's code stays as it is. What needs updating is the PHP your server runs.
What to update
PrizeX, BidKing and RaffKing need PHP 8.2 or newer, so your store runs on one of these. Update to at least the fixed release of your version:
- PHP 8.5: 8.5.12 or newer
- PHP 8.4: 8.4.27 or newer
- PHP 8.3: 8.3.36 or newer
- PHP 8.2: 8.2.35 or newer. PHP 8.2 gets no security fixes after 31 December 2026, so plan a move to a newer version too.
A Linux distribution's own PHP package may carry the fix under a different version number. If you install PHP from your distribution, check its security notice for these two CVEs.
How to do it
- On shared or managed hosting, check the PHP version in your hosting panel and ask your host whether their PHP has the 21 October fixes. If the panel lets you pick a version, choose a fixed one.
- On your own server, update the PHP packages with your system's package manager, then restart PHP, for example PHP-FPM, and your web server, so every PHP process runs the new version.
- Check the version your store actually runs. The
php -vcommand shows the command-line PHP, which can differ from the one serving your pages. Your hosting panel, or your web server's PHP-FPM service, tells you which version the website uses.
If you can't update today
PHP's security advisory lists stopgaps, such as turning off session upload progress with session.upload_progress.enabled=0 in php.ini or the PHP-FPM pool, then restarting every PHP process. PrizeX doesn't use session upload progress, so turning it off doesn't change anything in your store. PHP says these stopgaps don't cover every variant, so update as soon as you can.
Common questions
Is this a bug in PrizeX?
No. Both flaws are in PHP itself, the language your server uses to run the store, so they affect PHP sites of every kind. PrizeX needs no code change, and no store update fixes them. The fix is a newer PHP on your server.
Which PHP version do I need?
At least the fixed release of the PHP version you run: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, all released on 21 October 2026. PrizeX, BidKing and RaffKing need PHP 8.2 or newer, so one of these covers every store. A Linux distribution's own PHP package can carry the fix under a different number, so check its security notice.
I'm on shared hosting. What do I do?
Your host runs PHP for you. Check the PHP version in your hosting panel, ask your host whether their PHP has the 21 October fixes, and if your panel lets you choose, switch to a fixed version.
Can I protect the store before I can update?
Only partly. PHP's advisory names stopgaps, such as turning off session upload progress (session.upload_progress.enabled=0 in php.ini or the PHP-FPM pool, then restarting PHP). PrizeX doesn't use that feature, so turning it off doesn't affect the store. PHP says these don't cover every variant and that updating is the only complete fix.