Summary
On 21 October 2026, the PHP project released urgent fixes for two critical security vulnerabilities, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language that powers websites and online services around the world, including Link My Books.
⚠️ Link My Books has been fully patched. You don't need to do anything.
What happened
The vulnerabilities affect PHP services that are open to the internet. They could allow an attacker to run code on an unpatched server. Security agencies, including CISA and the UK's NCSC, advised every organisation running PHP to patch straight away.
What we did
Date/Time | Event |
21 Oct 2026, 14:57 UK time | We identified the issue on the day it was announced. |
21 Oct 2026, 16:12 UK time | We applied the protective measures recommended by PHP's own security team to all of our production servers. |
22 Oct 2026, 10:05 UK time | We upgraded our platform to the patched version of PHP (8.3.36), which fully resolves both vulnerabilities. |
Is my data affected?
After a full scan of our logs, we are not aware of any unauthorised access to customer data, including data from your connected sales channels (such as Shopify, Amazon or eBay) and your accounting software.
Do I need to disconnect or reconnect anything?
No. You don't need to disconnect your sales channels or accounting software, or change any settings. If you disconnected an integration as a precaution, it's safe to reconnect it.
Questions?
If you have any questions about this, or your organisation needs a written confirmation for its security records, just message our support team using the chat in the bottom-right corner.