All security fixes are now deployed across the Acquired environment. Both the eMudhra certificate compromise and the critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) are fully resolved on our side, and merchant data and payment processing remain secure.
If you host PHP web applications, such as WordPress, WooCommerce or Magento, please make sure PHP has been upgraded to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. This needs to be done on your side.
If you have any questions, contact Acquired Support.
Posted Oct 22, 2026 - 15:42 BST
Update
To confirm, there will be no impacts to processing during these updates.
Posted Oct 22, 2026 - 14:53 BST
In progress
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Posted Oct 22, 2026 - 14:30 BST
Scheduled
We’re carrying out security maintenance in response to two critical vulnerabilities disclosed this week.
eMudhra intermediate certificate compromise:
The private keys for several intermediate certificates issued by eMudhra can be recovered. This lets someone impersonate websites to any software that still trusts those certificates. Major browsers and operating systems have now revoked them. We completed this maintenance across the Acquired environment on the evening of 21 October, and merchant data and payment processing remain secure.
These two flaws, each rated CVSS 9.2, can allow unauthenticated remote code execution on servers running PHP. The patch is being tested now and will be deployed by the end of today, 22 October. We’ll update this notice once it’s complete.
Recommended action for merchants
The PHP vulnerabilities are in PHP itself, not in the Acquired WooCommerce plugin. Our plugin is not affected and doesn’t need an update. However, PHP runs on your own servers or hosting, so the upgrade has to be done on your side.
WordPress, WooCommerce, Magento (Adobe Commerce) or anything else that runs on PHP: Ask your developer, agency or hosting provider today to upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. This applies to all PHP web applications you host, whether or not they integrate with Acquired.
Servers and devices: Keep operating systems, browsers and CA certificate bundles up to date.