Volusion relies on PHP to power and serve our merchant storefronts and management tools. On October 20, 2026, a critical PHP vulnerability was disclosed publicly. This vulnerability is referred to as "php2shell" and formally tracked as CVE-2026-109618 and CVE-2026-109619.
We want to reassure our merchants that your Volusion store has remained fully protected throughout this event: - Our security partner, Cloudflare, successfully deployed mitigating protections across all Volusion stores at 9:00 PM CT last night (October 20, 2026), neutralizing potential exploits at the edge. - There have been no signs or indications that any Volusion stores have been exploited. - Thanks to these active edge-level defenses, all stores remain secure while we complete our final patching process.
Posted Oct 21, 2026 - 18:50 CDT
This scheduled maintenance affects: Volusion Platform (Merchant Storefronts, Merchant Dashboard).