CubeCart 6.6.3 was released on 27 April 2026, twelve days after 6.6.2. It is a smaller release than 6.6.0 but it contains one change that matters to every store owner regardless of what they sell: the way your customer and administrator passwords are stored has been upgraded.
Passwords are now hashed with Argon2id. This is the current recommended standard, and it replaces the older scheme CubeCart used before. The important part for you is that the migration is transparent: existing accounts are upgraded to the new hash the next time each person logs in successfully. Nobody is forced to reset anything, and there is no bulk migration to run. Over time your password store quietly becomes more resistant to offline cracking if a database ever leaks.
Your dashboard is actually useful now. The admin dashboard was overhauled with a proper date range selector, abandoned cart statistics, a store news and announcements panel, a version notice so you can see at a glance whether you are behind, and progress widgets. If you previously logged in and went straight past the dashboard to the orders list, it is worth a second look.
Search got noticeably better if you use Elasticsearch. Six separate improvements went in. Search now takes a product’s primary category into account and boosts matches on the product name, so results are ordered more like a shopper would expect. Categories appear in search as you type. Reindexing uses the bulk API, which makes rebuilds substantially faster on larger catalogues.
There is also a gift certificate fix worth calling out, because it was costing people money: on stores using tax inclusive pricing, a rounding error meant a gift certificate could fail to clear the balance, leaving a penny or two outstanding and the order stuck. That is fixed.
Argon2id is the memory hard password hashing function that won the Password Hashing Competition and is what OWASP currently recommends for new applications. Memory hard matters because it raises the cost of the GPU and ASIC farms that make bulk password cracking cheap, in a way that iteration count alone does not.
The practical requirement is PHP support. Argon2id is available in PHP’s password_hash() from PHP 7.3 onwards provided the build includes libargon2 (PASSWORD_ARGON2ID). If your host built PHP without it, CubeCart will fall back rather than fail, but you will not get the benefit. If you are unsure which applies to your store, ask your host to confirm, or ask us and we will check it for you.
Because migration happens on login, an account that never logs in again keeps its old hash indefinitely. That is the correct trade off (the alternative is forcing a password reset on your whole customer base) but it does mean the improvement arrives gradually rather than all at once.
Six issues in this release, and together they change search behaviour enough that you should re-run a reindex after upgrading and then spot check your common search terms:
name and product_name consolidated into a single multi-field mapping, which removes a long standing source of inconsistent scoringIf you have ever had a rebuild produce a suspiciously small document count, that is a separate and known class of problem worth checking after any Elasticsearch change: confirm the document count in the indexer roughly matches your live product count before assuming the new relevance tuning is at fault.
Three related changes make extension management less opaque. There is a new Extensions tab on the dashboard with per administrator seen state, so a notification you have dismissed does not keep reappearing for you but still shows for a colleague. Installed extensions now display their enabled or disabled state in the listing, and can be toggled directly from there rather than having to open each one.
Order status change emails now include the full order data: billing address, shipping address, products and taxes. Previously these were sparse, which meant customers often had to go back to the original confirmation to work out what a status update actually referred to.
The bestseller statistics query was optimised and composite indexes added, which is the sort of thing you only notice on a catalogue large enough for the old query to hurt. A UNIQUE KEY was added to CubeCart_order_summary.custom_oid, with empty values converted to NULL first so the constraint can actually be applied to existing data. Duplicate index warnings in the maintenance tools no longer raise false positives, and CubeCart_email_log is now created on fresh installs, which it previously was not.
SEO::rewriteUrls was refactored away from running regular expressions over HTML for single URL processing. Regex on HTML is fragile by nature and this was a sensible thing to move away from. A related fix cleared up erroneous seo_path values on URLs of the form /shop/product-name.html?seo_path=product-name.html.
A sale price column on the product list. Sales reports filterable by product. Language pack version checking, and staying on the same tab when installing a language. Improved tab layout on small screens, the Clear Cache button repositioned, and the date range picker on product stats fixed. Bulk price processing was extended again, including multi-select on options, following the customer group pricing support added in 6.6.2.
No CVEs in this release, but two hardening fixes worth noting. HTML tags are now stripped from error messages before they are written to the system error log, which closes off a log injection vector. And the image cache no longer writes malformed .500 files when a source filename has no extension, which was both a correctness bug and a way to litter the filesystem with unexpected files.
6.6.3 is a good release with no reported regressions of the kind that affected 6.6.0, but it is not where you should stop. Later releases fixed serious security issues that 6.6.3 is exposed to, including the critical remote code execution flaw addressed in 6.7.3. Go to the current version.
What 6.6.3 is worth knowing about is Argon2id, because that change is now quietly running on your store every time somebody logs in, and the Elasticsearch relevance work, because it will have changed what your customers see when they search.