Every Magento store we host and manage has been updated against PHP2Shell, the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on October 21, 2026. If your store runs on our servers, there is nothing you need to do.
What PHP2Shell is
PHP2Shell is a pair of flaws in PHP itself, not in Magento or in any extension. They affect every server running PHP 5.4 or later, under both Apache and PHP-FPM, and let an attacker run code on the server without logging in. Researchers demonstrated a working attack against a clean Magento 2.4.9 install, and the first attack attempts were seen before the fix was even released.
Because PHP reads each request before the store code runs, Magento's maintenance mode, security extensions and store-level filters cannot stop it. The real fix is a PHP update on the server.
What we did
As soon as the fixed PHP releases were out, we updated PHP on all the servers we manage, so every store running a supported PHP version is now fully patched.
Stores on older PHP versions
PHP only ships security fixes for version 8.2 and later. Stores still running older versions, such as PHP 7.2, do not get an official fix. On those stores we have put a stopgap in place that blocks the known attack paths, but it is a temporary measure, not a permanent fix.
The only lasting solution is moving the store to a supported PHP version, which on older stores usually means upgrading Magento as well. If your store is in this group, talk to us about planning the upgrade.
Not hosted with us?
- Update PHP on every server now, or ask your hosting provider to do it today. You cannot fix this from inside Magento.
- On PHP 8.1 or older, there is no official fix. Ask your provider for a backported fix or a move to a supported version.
- Check that nothing got in first. Our free WhizzyScan checks your files and database for webshells and backdoors:
curl https://shopwhizzy.com/gowiz/external/agent | sh
The full technical details are in Sansec's PHP2Shell advisory.