Security Alert: PHP Security Update — Mitigation and Remediation Complete
Last updated: 26 October 2026 at 06:40 UTC
Status: All customer-facing servers protected. No customer action required.
Rose Perl Technology recently responded to two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthorized code execution on affected PHP servers.
We have completed the immediate mitigation and remediation work needed to protect our customer-facing services.
Current protection status
All customer-facing Rose Perl servers are now protected through one or both of the following measures:
Patched PHP software: Updated to a PHP release that addresses the vulnerabilities.
Firewall mitigation: Protected by Cloudflare’s Web Application Firewall (WAF) mitigation rules.
Cloudflare introduced protective rules on the morning of 21 October 2026, providing an additional layer of protection while our PHP updates were tested and deployed.
Status of our four apps
RP ProMap — Store Locator: Patched and verified in production by 22 October 2026 at 10:18 UTC.
RP ProPickup — Local Pickup & Delivery: Patched and verified in production by 22 October 2026 at 10:18 UTC.
RP ProFind — Product Locator: Patched and verified in production by 26 October 2026 at 06:40 UTC.
RP Local Delivery Date: Unaffected. This app does not use PHP and is not affected by these PHP vulnerabilities.
Other customer-facing PHP services are patched or protected by Cloudflare mitigation while longer-term upgrades and retirement work are completed.
Core application flows were tested after deployment and are operating normally.
Was customer or merchant information affected?
We have found no evidence of a security breach, unauthorized access, or exposure of customer or merchant data associated with these vulnerabilities.
We continue to monitor our systems and review relevant activity as a precaution.
Do I need to take any action?
No action is required from customers or merchants. These corrections were made at the server and infrastructure level.
What happens next?
We will continue upgrading legacy components, completing remaining long-term remediation work, and strengthening our infrastructure as part of our ongoing security program.
If you have questions, contact our support team through live chat.