PHP2Shell: what shop owners should do today, and how to stop patching
Two critical PHP flaws can let anyone run code on a shop’s server. What to do today on WooCommerce, Magento or OpenCart, and how to stop patching servers yourself. Checked against php.net on 21 October 2026.
On 21 October 2026 PHP released fixes for two critical security flaws, nicknamed PHP2Shell, that can let someone on the internet run their own code on a web server running PHP, without logging in. This guide is for owners of shops built on PHP software: WooCommerce, Magento, OpenCart, PrestaShop and the rest. Every fact below was checked against PHP’s own security advisory on 21 October 2026 and is linked to its source. Disclosure: we build Orbit Commerce, a hosted ecommerce platform that doesn’t run on PHP, so we have an interest in the last section. There is one Orbit paragraph and it is at the end.
The short version: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today, or confirm your host has. If your site still runs PHP 8.1 or older, no official fix is coming: install a backported fix from your host or Linux distribution today, or take the site offline until you have moved to a supported version. Updating WordPress, WooCommerce or a security plugin doesn’t help, because the flaws are in PHP itself.
What is PHP2Shell?
PHP2Shell is the name going around for two vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Word of them leaked on 20 October, ahead of the planned disclosure, and PHP published fixed releases as scheduled at 14:00 UTC on 21 October (PHP security advisory, checked 21 October 2026). PHP rates both critical, 9.2 on the CVSS v4 scale.
Both are remote code execution flaws: someone sends your server a web request and gets it to run their code. PHP’s advisory says they can be triggered without logging in, and rates the risk highest on Apache with mod_php, where it has seen a working attack start before any of the website’s own code runs. Anyone who can run code on your server can read your database, copy customer details, plant a card skimmer in your checkout or use the machine for something else entirely.
The technical detail is in PHP’s two advisories on GitHub, for CVE-2026-109618 and CVE-2026-109619. In short, one comes from how PHP cleans up after running out of memory part-way through a request, and the other from leftover state that can survive from one request into the next.
Is your shop affected?
If your shop runs on PHP and PHP hasn’t been updated yet, yes. PHP’s advisory covers every PHP installation that serves web requests, however PHP is connected to the web server: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all named. WooCommerce (which runs on WordPress), Magento and Adobe Commerce, OpenCart, PrestaShop and Shopware are all PHP applications.
Who has to install the update depends on how the shop is hosted:
| How your shop is hosted | Who updates PHP | What to do today |
|---|---|---|
| Shared hosting with cPanel or Plesk | Usually the host, but you choose which PHP version your site runs | Check your version in the control panel and ask the host when the fixed builds go live |
| Managed WordPress or WooCommerce hosting | Usually the host | Ask the host to confirm it has updated, and when |
| A VPS or server you or a developer manage | You | Install your Linux distribution’s updated PHP packages, then restart PHP and the web server |
| A hosted platform where you never log in to a server | The platform | Nothing on the server side. If you’re unsure, check the platform’s status page |
What should you do today?
- Find your PHP version. In WordPress, go to Tools, then Site Health, open the Info tab and expand Server. WooCommerce also shows it under WooCommerce, then Status. On cPanel hosting, MultiPHP Manager lists the version for each site. Or ask your host.
- On PHP 8.2 to 8.5, update to the fixed release: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP sent the patches to Linux distributions and long-term support vendors in advance, so updated packages may already be waiting. If your server uses its distribution’s packages, the version number may not change, because distributions often add fixes to their own builds: check the distribution’s security notice for the fixed package instead.
- On PHP 8.1 or older, act today, because no official fix is coming. The PHP project no longer updates 8.1 and older. Install a backported fix from your host, your Linux distribution or a paid long-term support vendor today, or move to a supported version. If neither can happen today, ask your host to take the site offline until it can: the attack needs no login, so a shop left online while you plan stays exposed. PHP also published minimal source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves. Before upgrading, take a full backup and test on a staging copy, because older plugins and themes can break on newer PHP.
- If you can’t update today, ask your host about PHP’s stopgaps. The advisory lists settings that block the known attack paths, such as setting session.upload_progress.enabled to 0 and lowering post_max_size, but PHP says plainly that they “do not make an installation safe”. They buy hours, not safety.
- Then check nobody got in. No indicators of compromise have been published yet. The usual checks still catch most shop break-ins: admin accounts you don’t recognise, new files in the website’s folders (PHP files inside an uploads folder are a red flag), changes to checkout or payment scripts, and new scheduled tasks. Huntress suggests watching for PHP processes starting shells or download tools (Huntress, checked 21 October 2026). If something looks wrong, take the site offline, keep the logs and get help before you clean up.
Why does this keep landing on shop owners?
Because on self-hosted software, the server is part of the shop. A WooCommerce store is PHP, a web server, WordPress, WooCommerce, a theme and a stack of plugins, each with its own security releases, and any of them can need an urgent update on a day that suits an attacker rather than you. PHP itself supports each version for four years, two with full support and two with security fixes only, and then it reaches end of life (PHP supported versions, checked 21 October 2026). So every few years the version your shop runs on stops getting fixes, and moving up means testing every plugin and theme against the new one.
PHP2Shell is a big one, but its shape isn’t unusual. Most of the time the urgent fix is a plugin update nobody writes about, and the cost shows up as evenings spent updating and testing, or a monthly retainer for someone who does it for you. Our breakdown of what self-hosted WooCommerce really costs puts numbers on that.
How do you stop having to patch your shop yourself?
There are three realistic ways, and each moves the work somewhere else, at a price:
| Option | What you still look after | The trade-off |
|---|---|---|
| Managed WordPress or WooCommerce hosting | WordPress, WooCommerce, your theme and plugins, and testing their updates | The host looks after PHP and the server, for more a month than shared hosting |
| A maintenance plan from a developer or agency | Approving changes and paying the retainer | Someone else applies and tests updates, for a monthly fee |
| A hosted ecommerce platform | Your products, content, orders and customers | No server, PHP or plugins to update, but you move platform once and work within what it offers |
Only the hosted platform takes patching off your list entirely. The cost is the move itself. For a small, tidy store that’s a weekend of exports, imports and redirects, and our guide to changing platform without losing your search rankings covers the part that matters most. WooCommerce alternatives for UK stores compares the platforms on price.
Questions people ask about PHP2Shell
What is PHP2Shell?
PHP2Shell is the name going around for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. They can let someone run their own code on a web server running PHP without logging in. PHP rates both 9.2 on the CVSS v4 scale.
Is WooCommerce affected by PHP2Shell?
The flaws are in PHP rather than WooCommerce, but every WooCommerce shop runs on PHP, so every one is exposed until the server’s PHP is updated. Updating WordPress, WooCommerce or a security plugin doesn’t fix it. Update PHP, or have your host do it.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026. If your server uses your Linux distribution’s PHP packages, the version number may not change, so check the distribution’s security notice for the fixed package instead.
What if my site runs PHP 7.4 or 8.1?
The PHP project no longer updates 8.1 and older, so act today: install a backported fix from your host, Linux distribution or long-term support vendor, or move to a supported version. If neither can happen today, ask your host to take the site offline until it can, because the attack needs no login. PHP also published minimal source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves. Test any upgrade on a staging copy first, because older plugins and themes can break on newer PHP.
Do I need to do anything if my shop is on a hosted platform?
Not on the server side. On a hosted platform such as Shopify or Orbit, the provider runs the servers, so patching them is its job rather than yours. If you also run a separate WordPress site, for a blog for example, that one still needs its PHP updated.
How do I stop having to update PHP myself?
Hand the job to someone else. Managed hosting takes PHP and the server off your hands but leaves WordPress and plugins with you, a maintenance plan hands over the updates for a monthly fee, and a hosted ecommerce platform takes the server, PHP and plugins off your list altogether.
Where Orbit fits
Orbit Commerce is a hosted platform and isn’t built on PHP, so PHP2Shell doesn’t reach Orbit shops and no Orbit merchant had anything to update today. When the next vulnerability lands in software we do use, patching our servers is our job, not yours: hosting, security patching and updates are part of the plan, and so are the features you’d otherwise add as plugins. If today has you thinking about it, leaving WooCommerce walks through the move, the Orbit vs WooCommerce page has the side-by-side, and the 14-day free trial, no card required, is long enough to build the new shop while the old one keeps selling.