Resolved on October 22, 2026, affecting Servers.
On 20 and 21 October 2026, two critical vulnerabilities in PHP were disclosed (CVE-2026-109618 / CVE-2026-109619). Many websites and online shops run on PHP, including parts of Payrexx. On 21 October 2026, we applied a protective measure even before the official update was available, and rolled out the fixed PHP version across the entire platform the same evening. Payrexx services ran without interruption. We have found no indication that the vulnerabilities were exploited on our systems. No action is required for your Payrexx account. If you run your own online shop on PHP, e.g. WooCommerce, Magento or Shopware, please ask your hosting provider or web agency to confirm that PHP has been updated.
Affected components
Update timeline
- resolved Oct 22, 2026, 10:06 AM UTC
On 20 and 21 October 2026, two critical vulnerabilities in PHP were disclosed (CVE-2026-109618 / CVE-2026-109619). Many websites and online shops run on PHP, including parts of Payrexx. On 21 October 2026, we applied a protective measure even before the official update was available, and rolled out the fixed PHP version across the entire platform the same evening. Payrexx services ran without interruption. We have found no indication that the vulnerabilities were exploited on our systems. No action is required for your Payrexx account. If you run your own online shop on PHP, e.g. WooCommerce, Magento or Shopware, please ask your hosting provider or web agency to confirm that PHP has been updated.
Your product runs on more than Payrexx
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services