On October 21, 2026, two critical security vulnerabilities affecting PHP, the programming language powering millions of websites and applications worldwide, were publicly disclosed. These vulnerabilities, collectively known as php2shell (CVE-2026-109618 and CVE-2026-109619), could potentially allow attackers to disrupt services, access sensitive information, or execute unauthorized code.
We want to reassure our customers that Zoey has multiple layers of security in place to protect against these threats.
Cloudflare Protection Is Already Active
Zoey’s infrastructure is protected by Cloudflare, a global leader in web security and network protection.
All customer-facing Zoey storefronts are routed through Cloudflare’s network, providing an important layer of protection before traffic reaches our application servers.
Cloudflare has confirmed that it has proactively deployed Web Application Firewall (WAF) protections specifically designed to detect and block exploitation attempts targeting these newly disclosed PHP vulnerabilities.
According to Cloudflare, these protections were deployed ahead of the public disclosure and are enabled by default for customers using its WAF services.
You can read Cloudflare’s official announcement here:
Cloudflare Deploys Protections Against php2shell Vulnerability
Additional Security Measures and Patching
While Cloudflare’s protections provide an important layer of defense, we recognize that network-level security measures are not a replacement for updating the underlying software.
Our engineering team has deployed the necessary security updates across our infrastructure and all servers have been updated.
We will continue monitoring developments and implementing additional protective measures as appropriate.
Our Commitment to Security
Security is a fundamental priority at Zoey. Our layered approach combines network-level protection, application security controls, infrastructure monitoring, and ongoing software maintenance.
We will continue taking proactive measures to protect our customers and their businesses as the situation evolves.
No action is required from Zoey customers at this time.
We appreciate your continued trust in Zoey.
— The Zoey Team
