Your store stays protected. No steps required
At Consentmo, protecting our merchants and their customers is a top priority. When new security vulnerabilities are identified, we act quickly to ensure our infrastructure remains protected.
Following the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, we want to reassure our merchants that Consentmo was not affected, and no action is required on your part.
Although our existing PHP version was not affected by these vulnerabilities, we proactively updated to the latest PHP release as an additional precaution, reinforcing the security measures already in place.
Here's what you need to know.
What Are CVE-2026-109618 and CVE-2026-109619?
On October 21, 2026, two vulnerabilities affecting the PHP programming language were publicly disclosed:
- CVE-2026-109618: A vulnerability involving memory handling during PHP request processing.
- CVE-2026-109619: A vulnerability involving the reuse of internal memory after it has been released.
Collectively known as PHP2Shell, these vulnerabilities could allow unauthorized code execution on servers running affected PHP versions.
The PHP security team released patches on October 21, 2026, with additional technical guidance published by Google Cloud.
How Consentmo Is Protected
Consentmo has addressed both PHP vulnerabilities through two layers of protection:
1. Cloudflare Security Protection
All connections to our PHP servers are proxied through Cloudflare, providing an established first layer of defense against malicious traffic and potential attacks.
2. Updated and Patched PHP Servers
As soon as the patched PHP versions became available on October 21, 2026, our team deployed the security updates.
All requests reaching Consentmo's PHP servers are now handled by the updated, patched PHP runtime, addressing both CVE-2026-109618 and CVE-2026-109619.
Together, these measures help protect our infrastructure against the reported vulnerabilities.
What Does This Mean for Consentmo Merchants?
No action is required on your side.
The necessary security updates have already been implemented on Consentmo's infrastructure. You do not need to change your app settings or take additional steps to receive these protections.
Our team continues to monitor security developments and maintain the safeguards supporting our Shopify merchants.
Our Ongoing Commitment to Security
Protecting merchant and customer information goes well beyond responding to individual vulnerabilities.
Consentmo maintains a broader security program that includes:
- ISO 27001 certification and a completed SOC 2 Type 2 examination.
- Regular security assessments, vulnerability management, and penetration testing.
- Encrypted data transmission and storage, together with strict access controls.
- Continuous infrastructure monitoring and established incident response procedures.
Security remains a continuous priority as we develop and improve Consentmo.
Learn more about our security practices, infrastructure protections, and certifications on our Security at Consentmo page.
