Nets Easy incident
PHP vulnerability (PHP2Shell) CVE-2026-109618/CVE-2026-109619
Resolved on October 22, 2026, affecting Nets Easy Other Components.
We would like to inform you about recently identified security vulnerabilities affecting PHP (CVE-2026-109618 and CVE-2026-109619), which may impact certain e-commerce platforms and hosting environments. These vulnerabilities are not specific to Nexi's payment plugins but may affect the environments in which they operate. What action should you take? Self-hosted solutions: If you manage your own hosting environment, we recommend reviewing your PHP version and applying the relevant security updates as soon as possible. Managed hosting solutions: If your online store is hosted by a third-party provider, security updates are typically managed by your hosting provider. We recommend confirming that the necessary updates have been applied. We encourage you to review your environment with your technical team or hosting provider and take any necessary actions to ensure your online store remains secure. For further technical details, affected versions and available security updates, please refer to the official PHP security advisory: https://www.php.net/archive/2026.php#2026-10-21-5
Affected components
Update timeline
- resolved Oct 22, 2026, 10:27 AM UTC
We would like to inform you about recently identified security vulnerabilities affecting PHP (CVE-2026-109618 and CVE-2026-109619), which may impact certain e-commerce platforms and hosting environments. These vulnerabilities are not specific to Nexi's payment plugins but may affect the environments in which they operate. What action should you take? Self-hosted solutions: If you manage your own hosting environment, we recommend reviewing your PHP version and applying the relevant security updates as soon as possible. Managed hosting solutions: If your online store is hosted by a third-party provider, security updates are typically managed by your hosting provider. We recommend confirming that the necessary updates have been applied. We encourage you to review your environment with your technical team or hosting provider and take any necessary actions to ensure your online store remains secure. For further technical details, affected versions and available security updates, please refer to the official PHP security advisory: https://www.php.net/archive/2026.php#2026-10-21-5
Your product runs on more than Nets Easy
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services