What is PHP2Shell?
PHP2Shell is the name given to two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. The PHP project released the fixes on the afternoon of 21 October 2026, Central European time. Both vulnerabilities carry an official severity of 9.2 out of 10 under CVSS v4.0. Under certain conditions, an attacker can run their own code on the web server without logging in.
Fixed releases exist for four PHP version branches:
- 8.2.35
- 8.3.36
- 8.4.27
- 8.5.12
The Swedish national CERT, CERT-SE, issued an advisory the same day. Five days later, the US agency CISA added both vulnerabilities to its catalogue of vulnerabilities exploited in real attacks.
What it means for a Magento store
Magento and Adobe Commerce run on PHP. So do Shopware and WooCommerce. The vulnerabilities sit in PHP itself. A Magento store with every Adobe security patch installed can therefore still be exposed.
The reverse is also true. An updated PHP version does not replace Magento's own security patches, and the store needs both. Responsibility for the two often sits with different parties. The host normally manages PHP on the server. The agency or in-house developer normally manages Magento.
How to check that your store is patched
The check must cover the PHP that actually handles visitor requests. A server can have several PHP versions installed. The command line can show a fixed version while the web server still runs an older one.
- Check the version number of the web server's PHP. Whoever has server access or access to the hosting control panel can see it. Compare it with the fixed releases above.
- Check that PHP was restarted after the update. An installed update only takes effect once the PHP processes have been restarted.
- Ask for the source if the version number is lower. PHP installed from a Linux distribution's packages can show an older version number and still include the fix. In that case, your supplier should be able to point to the distribution's security notice for the package.
- Don't forget test environments. An older staging site that is reachable from the internet and shares a database with the store can give the same access as the live store. It needs the same update.
- Get the answer in writing. A version number and an installation date tell you more than a verbal yes.
What to ask your host
Your host is usually the right party to ask first, because it manages PHP on the server. The questions below give you an answer you can verify.
- Which PHP version and package does the web server run for our store today?
- When was the fix for CVE-2026-109618 and CVE-2026-109619 installed?
- Have both the web server's PHP and the command line PHP been updated?
- Do you keep logs from before the update, in case we need to look for signs of intrusion?
- How will you handle the next critical PHP release, and how quickly will we hear from you?
If your host only provides the server and doesn't manage PHP, responsibility lies with whoever administers the server. That may be your agency or an in-house resource. The guide to cloud infrastructure for ecommerce explains how responsibility is usually split between hosting and development.
If your store runs PHP 8.1 or older
The PHP project released no official fixes for version 8.1 or older. Stores on PHP 7.4 to 8.1 depend on their Linux distribution or host having applied its own fix.
CERT-SE recommends isolating internet-facing PHP applications from public networks if the updates cannot be applied. For an online store, that is an emergency measure in practice, because the store cannot take orders while isolated. The lasting fix is to upgrade PHP.
A PHP upgrade often requires a Magento upgrade, since each Magento version supports only certain PHP versions. Third-party extensions also need testing against the new version. Plan the upgrade as a project with a staging environment. If the store is facing a larger platform decision anyway, the guide to ecommerce migration explains what a platform change involves.
Check for intrusion after patching
An update closes the door to new attackers. It does not remove an attacker who is already inside. Details of the vulnerabilities leaked the day before the fix, and attacks were confirmed within days. A store that was patched late should therefore be checked for signs of intrusion.
On ecommerce sites, an intrusion often ends with a payment skimmer on the checkout. It copies card details as customers type them and shows up in the customer's browser rather than on the server. Another common sign is a backdoor in the form of unknown PHP files on the server. New admin accounts and unfamiliar scheduled tasks are also worth checking. The guide to ecommerce malware protection explains how server-side scanning and checkout monitoring complement each other.
Experience from earlier Magento vulnerabilities points the same way. The article Magento security: lessons from SessionReaper and CosmicSting shows how the time between fix and installation decided which stores were hit.
Set a routine for the next release
More critical PHP releases will follow. The main lesson is that the time from release to installation is measured in hours. At Nordic Web Team, every client running PHP was patched within 17 hours, as the article on the PHP update describes step by step.
A working routine needs a named owner for PHP and a named owner for the platform. It also needs an up-to-date record of which PHP versions the store's environments run, and an agreed timeframe for critical updates. With that in place, the question of whether your store is patched takes minutes to answer.