Last updated: 22 October 2026, 03:40 UTC
On 21 October 2026, two critical vulnerabilities in PHP were made public: CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell". Relocate+ uses PHP, and our PHP version is within the affected range. We put protections in place on the same day.
What happened
PHP is a programming language that runs a large share of websites in the world. These two vulnerabilities can let an attacker run code on a server that uses an affected PHP version. The attacker does not need to log in.
Relocate+ runs on a PHP backend. That includes the Relocate+ admin app and the order editing pages your customers see on your store.
What we've done
On 21 October, the day the vulnerabilities were disclosed, we did the following:
- All traffic now goes through Amazon CloudFront and AWS WAF. AWS WAF is Amazon's web application firewall. This includes the order editing pages your customers use. Our servers no longer accept web traffic directly from the internet.
- We turned on the protections Amazon recommends for these vulnerabilities. These come from AWS security bulletin 2026-143-AWS. We also turned on AWS protections that block known malicious IP addresses and known attack patterns.
- We tested the protections. We sent test requests shaped like the attack, and the protections are blocking them.
What happens next
PHP upgrade. We are upgrading PHP to a patched release. This work is in progress. We will update this post when it is complete.
Security review. We are reviewing our systems and logs for any sign of unauthorized access before these protections were in place. This includes the data Relocate+ handles when customers update their shipping address. The review is not finished yet. We will update this post with the result as soon as possible.
If we find a problem. If we find anything that affects your store or your customers' information, we will contact you directly, as soon as possible.
Do I need to do anything?
No. You don't need to change any settings or reinstall anything. Relocate+ keeps working as normal for you and your customers.
Questions?
Contact us at squad@crowdcontrol.co. You can also reply to the email we sent you about this.
Updates
We will add dated updates here.
