PHP2Shell: store owners must update PHP now

PHP, the scripting language behind many online stores, released emergency fixes on 21 October 2026 for two flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell⁴, that can allow unauthenticated remote code execution³. The flaws are in the PHP runtime, not in store software, so stores on Magento, Shopware and WooCommerce are affected even when their own code is clean⁷. Store owners who run PHP on their own servers must update it or ask their host to, and sources disagree on how widely the flaws are being exploited.

The PHP advisory and mailing-list announcement are written for server administrators. The store-owner steps below draw on the PHP advisory and Sansec's guidance. Sources were checked on 24 October 2026; the official PHP advisory is at https://www.php.net/archive/2026.php#2026-10-21-5³.

What happened: PHP ships emergency fixes for two critical flaws

On 21 October 2026 the PHP development team announced PHP 8.5.12 as a security release fixing both CVEs. The announcement is dated 14:10:11 UTC³. The same fixes are in PHP 8.4.27, 8.3.36 and 8.2.35². The announcement states: "There are no complete mitigations, updating is the only safe choice."³

Details became public on 20 October, before the planned release¹. PHP had scheduled the release for 22 October, but moved it up by a day after the CVE identifiers leaked⁵.

The two flaws work differently. CVE-2026-109618 involves out-of-memory handling, where PHP can be interrupted while request data is only partly set up. CVE-2026-109619 involves request-owned internal state that survives after its memory has been freed². Both are rated 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0⁴.

Which stores are exposed

PHP's advisory says every PHP installation that serves web requests is in scope. It lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed². PHP considers the risk highest for mod_php².

Sansec reports that the flaws sit in the PHP engine, so Magento, Shopware and WooCommerce stores are affected even when their own code is clean⁷. Calif, the researcher that reported the flaws, showed that an attacker without a login can run code on Magento 2.4.9, WordPress 7.1.2 and several other platforms⁷.

Versions matter. The fixed branches are 8.5.12, 8.4.27, 8.3.36 and 8.2.35⁴. PHP 7.4, 8.0 and 8.1 have no official release, and PHP 7.3 and older, including PHP 5, have no fix available⁴.

Scale is large. Censys counted about 1.57 million unpatched PHP hosts out of roughly 1.58 million hosts reporting identifiable PHP versions on 21 October⁶. These are internet-wide counts, not store counts. A hosted store's exposure depends on the PHP build its provider runs, so treat every hosted store as unverified until the provider confirms otherwise.

Who must act

• Store owners who run their own servers must update PHP. Sansec says: "Update PHP on every server: you cannot fix PHP2Shell from within your store code."⁷
• Store owners on hosted platforms should ask the provider to apply the update. Sansec says: "If you do not manage your own server, ask your hosting provider to apply the update."⁷
• Linux distributions and LTS vendors received the patches in advance, so PHP says site operators should check their vendor for updated packages².
• Agencies and developers who manage client stores should check every server they run. BlueVoyant CISO John Harbaugh said: "Events like this expose forgotten applications, shadow systems and PHP installations that network owners may not even know exist."⁶

What store owners should do now

The steps below follow the six-step diagram.

1. Check the PHP version each store runs against the fixed branches: 8.5.12, 8.4.27, 8.3.36 or 8.2.35².
2. Check your Linux distribution or LTS vendor for updated PHP packages, as PHP advises².
3. Update to a fixed version. If you run PHP 8.1 or older, PHP says to contact your vendor for backported fixes or upgrade to a supported version². Sansec notes that a fixed package keeps its PHP version number, such as 8.1.34, and gets a new package release⁷.
4. Confirm the new version is running after the update. Sansec advises looking for the CVE in the package changelog, and restarting PHP-FPM or Apache⁷.
5. Review logs for requests probing for affected servers. Amazon reports probing from 17 October 2026⁶, so logs from that date onward are the place to start. Watch for web server processes that start shells or download tools⁸.
6. Ask your host or platform provider to confirm in writing that its servers are patched.

If you cannot patch at once, PHP lists partial settings but says they do not make an installation safe². Sansec says you do not need to take your store offline⁷. Its temporary step is to reject multipart/form-data requests at the web server, which breaks file uploads such as product images in the Magento admin, so remove that rule after updating⁷.

Exploitation: the reports disagree

Amazon says threat actors started probing for affected servers on 17 October, four days before the fixes, and that "PHP2Shell is now being broadly exploited in the wild"⁶. Cloudflare reported thousands of exploit attempts in the 10 hours before the announcement⁶.

watchTowr says it observed exploitation in the wild from 21 October 2026 through its Attacker Eye honeypot network⁴. Its head of threat intelligence said many of the circulating exploits either do not work, test for timing differences, or crash the target⁶.

Sansec's 22 October update says mass exploitation is "less likely than we expected on release day," and that public exploits do not work against a default PHP installation⁷. Sansec is also clear that updating is still required⁷.

CISA urged organisations to update immediately⁶. Its 21 October alert did not report observed exploitation⁸. As of 22 October, neither CVE was listed in CISA's Known Exploited Vulnerabilities catalogue⁴.

InternetRetailing says there is no public evidence that attackers exploited the flaws before the fix was deployed¹. Multiple organisations saw the activity but said the exploitation attempts were unsuccessful⁶.

What is not yet known

• How widespread exploitation is. Amazon, watchTowr, Sansec and CISA describe it differently, as shown above.
• Whether any store has been compromised. The sources used for this article do not report a compromised store.
• When CISA will catalogue the flaws. No date is given.
• How quickly shared and managed hosts will roll out patched PHP builds. The sources do not say.
• The next PHP release. PHP published an advisory on 23 October about session upload progress, a related setting. It says it will publish a full advisory for CVE-2026-115560 with the next release².