Ecommerce RFP and Website Maintenance Requirements After Critical PHP Security Updates

• Optimum7 published a guide to writing an ecommerce RFP on Oct. 28, with a B2B ecommerce RFP template covering PHP version, hosting environment, platform compatibility and post-launch maintenance ownership.
• The PHP project's Oct. 21 security updates fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10, which can allow unauthenticated remote code execution.
• PHP 8.2 reaches the end of its security support on Dec. 31, 2026, a separate deadline for stores still on that branch.

Miami, FL, Oct. 29, 2026 (GLOBE NEWSWIRE) -- Following the Oct. 21 release of critical PHP security updates addressing two vulnerabilities that can allow unauthenticated remote code execution, ecommerce development agency Optimum7 published "How to Write an eCommerce RFP," a guide for development projects, on Oct. 28. The guide sets out the ecommerce website maintenance requirements for a store's PHP version, hosting environment and platform compatibility, and who owns that work after launch.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were each rated 9.2 under version 4.0 of the Common Vulnerability Scoring System. The PHP project released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 across its supported branches and urged all users to update immediately.

For businesses running PHP-based ecommerce platforms, applying security updates may require coordination between hosting providers, developers and internal IT teams. The update may also need testing against custom extensions, third-party integrations and checkout functionality, and a web development RFP can assign each of those tasks before the build begins.

"An ecommerce merchant needs to know which PHP version the store runs, whether its platform and extensions support the update, and who is responsible for implementing and testing it," said Duran Inci, CEO of Ecommerce.com and Optimum7. "Those responsibilities belong in writing before an update forces the issue."

What should an ecommerce RFP include before development starts?

An ecommerce RFP records the project scope, the technical requirements, including the hosting environment and software versions, the testing and acceptance criteria, and who maintains the store after launch, according to Optimum7's guide. Its B2B ecommerce RFP template also covers ownership of security updates, compatibility testing, deployment procedures and post-launch support.

Optimum7 plans each eCommerce development project with a detailed execution schedule and roadmap before development and testing begin, and a written scope review is the first deliverable on every project. On Magento builds, the team reviews catalog structure, current integrations, traffic patterns and business requirements before scoping, and every deliverable, milestone and cost item is approved before development begins. QA is completed before every deployment.

When does a Magento store need a development company for PHP updates?

Magento Open Source requires developer skills to install, configure, update and maintain, according to Optimum7, so a PHP update on that platform goes to a developer when the store has no in-house team for the work. As a Magento development company, Optimum7 supports stores after launch with platform updates, bug fixes and performance monitoring, through a monthly development retainer or project-based support.

How does PHP version support affect an ecommerce RFP?

For a store built on PHP, the PHP version is one of the build's technical requirements, and each version has a published end date. The PHP project fully supports each version for two years, fixing reported bugs and security issues, and then for two more years for critical security issues only. PHP 8.3, 8.4 and 8.5 lose security support at the end of 2027, 2028 and 2029, after PHP 8.2 at the end of 2026. PHP 8.1 and older no longer receive updates from the PHP project, although for this release its security team provided minimal source backports for PHP 7.4, 8.0 and 8.1.

What is the difference between a PHP security update and a PHP version upgrade?

A security update stays within the same PHP version. The October release moved PHP 8.4 from 8.4.26 to 8.4.27, a point release on the same branch. A version upgrade moves a store to a newer release branch, such as PHP 8.2 to PHP 8.3. The work involved depends on which PHP versions the store's platform release, extensions and theme support.

Who handles ecommerce website maintenance and PHP updates after a development project launches?

On a self-hosted store, the merchant is responsible for making sure the server is maintained, and the contract records who takes that work on.

For the October fix, a server that gets PHP from a Linux distribution or a long-term support vendor can get the patched package from that vendor, since these vendors received the patches in advance, but someone still has to install it. A team that builds PHP from source has to compile and deploy the new version. On Oct. 23, the PHP project followed with an informational advisory recommending a temporary session setting for an unlikely remote code execution path, CVE-2026-115560. Watching for follow-ups like this one is part of the post-launch maintenance an ecommerce RFP assigns.

Do the October PHP vulnerabilities affect every ecommerce website?

The vulnerabilities affect ecommerce websites whose servers run PHP. The PHP project's advisory covers PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, so stores whose servers do not run PHP fall outside it. For a store that does run PHP, installing the October update is maintenance to do now, separate from any website development RFP for a future build.

Sources: PHP project, "Security advisory: Critical remote code execution vulnerabilities, update now" (php.net, Oct. 21, 2026); PHP project, "Upcoming Critical PHP Security Release" (php.net, Oct. 20, 2026); PHP project, "Informational advisory: Session upload progress" (php.net, Oct. 23, 2026); PHP project, "Supported Versions" (php.net).

About Optimum7

Optimum7 is a full-service ecommerce development and migration agency based in Coral Gables, Florida, specializing in platform migrations, custom ecommerce development and digital marketing for B2B manufacturers, distributors and wholesale operators. Founded in 2007, the firm has completed more than 1,000 ecommerce migrations and more than 3,000,000 cumulative page migrations across BigCommerce, Shopify Plus, Magento, WooCommerce, Volusion and other ecommerce platforms. Optimum7 holds BigCommerce Elite Partner status and is a Shopify Plus Partner.

Beyza Aydogan
PA to CEO, Optimum7
beyza@optimum7.com