Last updated: 23 October 2026
Summary
On 21 October 2026, the PHP project released urgent fixes for two critical security vulnerabilities, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language that powers websites and online services around the world, including Link My Books.
✅ Link My Books has been fully patched. You don't need to do anything.
What happened
The vulnerabilities affect PHP services that are open to the internet. They could allow an attacker to run code on an unpatched server. Security agencies, including CISA and the UK's NCSC, advised every organisation running PHP to patch straight away.
What we did
Date/Time | Event |
21 Oct 2026, 14:57 UK time | We identified the issue on the day it was announced. |
21 Oct 2026, 16:12 UK time | We applied the protective measures recommended by PHP's own security team to all of our production servers. |
22 Oct 2026, 10:05 UK time | We upgraded our platform to the patched version of PHP (8.3.36), which fully resolves both vulnerabilities. |
23 Oct 2026 | As a precaution, we began rotating all credentials and keys used by our application (see below). |
Is my data affected?
We have found no evidence of exploitation or unauthorised access to customer data, including data from your connected sales channels (such as Shopify, Amazon or eBay) and your accounting software.
Our review covers the whole exposure window, from 03:00 UK time on 21 October (before the earliest reported exploitation) to our upgrade at 10:05 on 22 October. It went well beyond access logs and covered:
Network traffic: our network intrusion-detection system raised no alerts, including for unusual outbound connections.
Server and application logs: our PHP request logs, container logs, error monitoring and cloud audit logs show no exploit signatures, no crash patterns linked to these flaws, and no requests to unexpected files that would indicate a planted "web shell".
Our production servers are also rebuilt from a clean, versioned image on every release. On 21 October every server was replaced three times, and again at the 10:05 upgrade on 22 October, so nothing written to a server during the window could persist.
Credentials and keys
Because these flaws allow code execution, we're treating every secret our application could read as potentially exposed, even though we have no evidence of misuse. As a precaution, we began rotating all of them on 23 October, in priority order, starting with database and encryption credentials. This includes our app credentials for every connected sales channel and accounting integration.
You don't need to do anything for this. Your connections will keep working.
Do I need to disconnect or reconnect anything?
No. You don't need to disconnect your sales channels or accounting software, or change any settings. If you disconnected an integration as a precaution, it's safe to reconnect it.
Optional, for Shopify merchants: your store's access token is stored encrypted, and you don't need to do anything. If you'd like a brand-new Shopify token for complete peace of mind, uninstall the Link My Books app from your Shopify admin and reinstall it. This issues a new token and cancels the old one, and your settings in Link My Books are kept.
Independent review and ongoing monitoring
Link My Books is part of the Visma group, and Visma's security team already receives our logs. They will independently review this period to confirm we haven't missed anything, and we are keeping the logs from the window for that review.
The vulnerability itself is fully patched, so the original attack route is closed. We continue to monitor for repeat attempts.
If anything changes
If we find anything that affects your data, we'll tell you straight away, and in any case within any timescale required by law. We'll also update this article as the credential rotation and independent review are completed.
Questions?
If you have any questions about this, or your organisation needs a written confirmation for its security records, just message our support team using the chat in the bottom-right corner.