Ha Ha
Sanitize Multipart Uploads is live
Two critical PHP flaws, patched across 8.2 through 8.5. Plus a new proxy-layer mitigation that covers the next parser bug too.
Sanitize Multipart Uploads is live
On October 21 PHP shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws rated 9.2 on CVSS v4.0. The parser bugs sit in PHP itself, so every PHP store is exposed until the runtime is patched.
The 2026.55 images carry the fixed releases for 8.2, 8.3, 8.4 and 8.5. We also shipped a new Web Control action, Sanitize Multipart Uploads, that buffers and validates multipart/form-data content at the proxy before any part of it reaches your app servers.
It covers the attack pattern these flaws depend on, and it keeps protecting your store on the next PHP parser bug too. Available to every customer at no extra cost.
Configure the mitigation →Ship log
Hosting v4 added an EKS stack type on October 23.
PHP2Shell: a heads-up for PHP merchants and partners
If you run a PHP store or deploy them for clients, this one hit the queue last week. PHP2Shell is two critical flaws in PHP itself that let attackers run code on any PHP server without logging in. The post walks through what shipped from the PHP project, what we hardened, backported and patched across customer environments, and the exact steps required depending on who manages your PHP runtime.
Read the post →Five things to do this cycle
Ordered by urgency. One owner per action.
BFCM is three weeks out.
One security miss and the peak costs more than the sale.
Pressure-test my stack →Forward this to whoever owns the deploy
Got this from a teammate? Subscribe for the platform changes, and what to do about them in your environment.