Critical PHP2Shell Alert: Secure Your Magento Store | HyvaGo

Critical PHP Security Alert: Act Now to Protect Your Store

PHP has two newly disclosed critical remote code execution (RCE) vulnerabilities that could let an attacker take over an exposed web server without logging in. If you run a Magento store, check your PHP version now and install the right security update without delay.

The PHP security team announced the two flaws on October 21, 2026. They are tracked as CVE-2026-109618 and CVE-2026-109619, each carries a CVSS score of 9.2 out of 10, and together they are referred to as PHP2Shell.

The problem lives in the PHP runtime itself. It is not tied to one eCommerce platform or extension. Researchers have reported both remote code execution and memory disclosure risks in affected PHP environments.

PHP runs a large share of the world’s websites, so these flaws matter for Magento, Adobe Commerce, WordPress, Drupal and any other PHP-based application.

Cloudflare has said it is seeing attack traffic aimed at its customers and has rolled out Web Application Firewall protections in response.

For Magento merchants, a successful attack could leak customer data, compromise site files, disrupt day-to-day operations, or plant malicious code in the storefront and checkout.

Important: Upgrading Magento core, switching themes or updating extensions will not close these PHP vulnerabilities. The fix is to update the PHP runtime or install a suitable security backport from a trusted vendor.

What Are the PHP2Shell Vulnerabilities?

Both flaws come from the way the PHP engine handles memory. In certain conditions, PHP can mishandle internal request data or keep pointing to memory that has already been freed.

An attacker can trigger these conditions with carefully crafted HTTP requests. Depending on which flaw is hit and how the server is configured, the result can be remote code execution or exposure of sensitive memory.

CVE-2026-109618: Out-of-Memory Handling Vulnerability

This flaw relates to how PHP deals with out-of-memory errors.

When PHP hits certain fatal memory conditions, internal request data can be left only partly initialised. During request cleanup, PHP may then use that data incorrectly, which can corrupt memory and open the door to remote code execution.

CVE-2026-109619: Use-After-Free Vulnerability

This flaw relates to PHP holding on to references to request memory after that memory has been freed.

The next request handled by the same PHP worker can run into this leftover state before normal initialisation clears it. Under the right conditions, this can corrupt memory and potentially lead to remote code execution.

Why Are These Vulnerabilities So Serious?

Attackers can trigger both flaws remotely, with no authentication required.

Because the defects sit inside PHP, a site can stay vulnerable even when its application code, Magento installation and extensions are all fully up to date.

Researchers have also shown working exploits against other PHP-based applications.

Magento merchants should treat this as a server-level security problem, not just routine application maintenance.

Affected PHP Versions and Security Fixes

The PHP security team has shipped fixed releases for the supported branches that are affected. Older branches need a different approach, as many of them are past the end of life.

What If Your Store Runs PHP 7.4, 8.0 or 8.1?

The PHP project has released source backports for these older branches, and some hosting providers and software distributors may also ship patched builds.

Keep in mind that a source backport is not the same thing as a regular, maintained PHP release. Make sure your host has applied the correct fix to the exact PHP package that serves your site.

The advisory table above lists no official fix for PHP 7.0 through 7.3. Stores on these versions need to move to a supported PHP branch, or use another verified remediation where one exists.

Our recommendation: Don’t leave a public-facing Magento store on an unsupported PHP version unless you have verified mitigation in place and a clear upgrade plan.

Magento Version Compatibility: Which PHP Version Is Right for You?

Installing the PHP security patch is essential, but first make sure your Magento or Adobe Commerce version actually supports the PHP version you plan to use.

Each Magento release supports only certain PHP branches. Jumping straight to PHP 8.5, for instance, is not the right answer for every installation.

Based on Adobe’s system requirements published as of October 22, 2026, these are the combinations that matter for this alert.

Magento and PHP Compatibility Matrix

This table covers PHP compatibility for the listed Magento release lines only. It does not mean every older patch release supports the same combination, so confirm your exact installed patch level before making any changes.

Magento 2.4.9

Magento Open Source and Adobe Commerce 2.4.9 support PHP 8.5.

The correct security update for this release is PHP 8.5.12 or later.

If you are already on Magento 2.4.9, don’t downgrade just to match an older PHP branch. Update the PHP runtime to the fixed release that Magento supports.

Magento 2.4.8

The latest published patch line of Magento 2.4.8 supports PHP 8.4 and PHP 8.3.

Install the matching PHP security update for this version:

• PHP 8.4.27 or later.

  
  

• PHP 8.3.36 or later.

  
  

Don’t move a Magento 2.4.8 production store to PHP 8.5 unless compatibility has been officially confirmed for that exact release. PHP 8.5 support comes with Magento 2.4.9.

Magento 2.4.7

The latest published patch line of Magento 2.4.7 supports PHP 8.3 and PHP 8.2.

In most cases, you can fix this vulnerability without changing your PHP minor branch by installing:

• PHP 8.3.36 or later.

  
  

• PHP 8.2.35 or later.

  
  

Even a PHP patch update should still be tested properly on staging and in production.

Magento 2.4.6

The latest published patch line of Magento 2.4.6 supports PHP 8.2 and PHP 8.1.

PHP 8.2.35 or later is the preferred fix, provided your installation and dependencies support it.

If your store is on PHP 8.1, the compatibility matrix alone doesn’t prove your runtime is secure. PHP 8.1 needs a verified vendor-supplied security backport, or a planned move to a supported PHP branch.

Magento 2.4.5 and Older Releases

Older Magento releases may be locked to PHP branches that no longer get standard upstream security fixes.

For these stores, you need to look at both the PHP vulnerability and the wider security status of the Magento application itself.

Depending on where you start, the fix may involve a phased Magento upgrade, replacing extensions, updating custom code and adjusting your hosting. Our Magento to Hyvä migration service can also be combined with a platform upgrade if you’re planning a frontend refresh at the same time.

A store that still loads is not automatically a secure one, so don’t treat an unsupported combination as safe.

What If Your Magento and PHP Versions Don’t Match?

Work through these steps:

1. Find your exact Magento version and security patch level.

   
   

2. Confirm which PHP runtime handles public web requests.

   
   

3. Check Adobe’s system requirements and the PHP packages your host supports.

   
   

4. Choose the fixed PHP branch that your Magento version supports.

   
   

5. Review third-party extensions, custom modules and Composer dependencies.

   
   

6. Test the storefront, admin panel, checkout, payments and background jobs.

   
   

7. Deploy with backups, monitoring and a rollback plan in place.

   
   

If no suitable patched runtime exists for your current setup, plan a controlled platform upgrade or work with your host on another verified mitigation.

Don’t hold off on a security review just because a full Magento upgrade needs time to plan. Put the safest available mitigation in place first, then finish the longer-term upgrade.

What Could This Mean for Your Magento Store?

A compromise at the PHP level can have serious commercial and operational consequences.

Customer data exposure

An attacker with enough access could reach customer records, order details, application secrets or other sensitive data.

Checkout compromise

Attackers may try to alter storefront scripts or checkout components to steal customer details or interfere with payments.

Malicious files and website defacement

Attackers can edit page content, inject harmful scripts or upload malicious files to a compromised server.

Business disruption 

A server breach can halt shopping, order processing, integrations and fulfilment.

Recovery and compliance costs

Investigating an incident, restoring clean systems, protecting affected customers and meeting any reporting obligations can add up quickly.

These are possible outcomes of a successful attack. Running a vulnerable PHP version does not automatically mean your store has already been breached.

How to Protect Your Magento Store?

Take these steps to reduce your risk.

Step 1: Identify the PHP Runtime Serving Your Website

Check which PHP version your live Magento storefront is using.

The PHP version on the command line can differ from the one used by PHP-FPM, Apache or another web server handler.

Confirm the runtime that actually handles public requests. Also check staging environments, background services, containers and any other PHP applications on the same infrastructure.

Step 2: Apply the Security Update

On supported PHP branches, install the correct fixed release.

On older branches, ask your hosting provider whether a suitable patched package or trusted source backport is available.

If you’re on managed hosting, ask for confirmation that the patch is active on the running PHP runtime, not just offered in the control panel.

Step 3: Check Magento and Extension Compatibility

Before switching PHP minor branches, review:

• Your Magento or Adobe Commerce version.

  
  

• Your theme and custom modules.

  
  

• Third-party extensions and Composer dependencies.

  
  

• PHP extensions and server configuration.

  
  

• Payment gateways and external integrations.

Plan the change carefully if you’re moving off an unsupported PHP branch. If you run a Hyvä storefront, our Hyvä compatibility modules service can help when an extension update is needed along the way.

Step 4: Test Your Store After the Update

Use staging wherever you can, keep a rollback plan ready, and check every critical business function.

Test the homepage, category pages, product pages, customer accounts, cart, shipping, discounts, checkout, payment gateway, admin panel, cron jobs, message queues and external integrations.

Check PHP and application logs for new errors, and confirm after deployment that the live site is actually running the patched PHP version.

Step 5: Enable Extra Security Protection

Cloudflare has rolled out WAF protections for PHP2Shell for customers using its managed WAF rulesets.

Keep these protections switched on and watch your security events for suspicious requests. Where your plan allows it, make sure the relevant rules are set to blocking mode.

Cloudflare adds an extra layer of defence, but it is not a substitute for updating PHP.

If you can’t patch right away, follow the official guidance on temporary mitigations and consider whether to restrict or disable the vulnerable service until a safe fix is in place.

If you think your store may already have been attacked, get a proper security investigation. Installing the patch alone won’t remove an existing compromise.

Why Updating Magento Extensions Isn’t Enough?

These flaws are in the PHP language runtime, not in Magento core, a specific theme or any one extension vendor.

Keeping Magento and third-party modules updated is still vital for overall security, but it won’t fix a vulnerable PHP installation.

For example, a fully patched Magento store running on PHP 8.3.20 would still need its PHP runtime updated to at least PHP 8.3.36.

The right fix is to update the PHP runtime, confirm the fix is active, and then test the application.

How Can HyvaGo Help?

HyvaGo provides Magento and Adobe Commerce development, support and maintenance, performance optimization and server support.

Our certified developers and DevOps engineers can help your business respond to PHP2Shell through a controlled, step-by-step remediation process.

PHP Security Assessment

We find out which PHP version your site is running, review your server configuration and identify the right security fix.

PHP Security Patch and Upgrade

We apply the correct PHP patch or work with your hosting provider to do it. If your current branch has no suitable fix, we plan an upgrade to a supported version.

Magento Compatibility Review

Before any PHP version change, we review Magento core, your theme, third-party extensions, custom modules, Composer dependencies and PHP extensions.

Checkout and Functional Testing

After remediation, we test your key shopping and order-processing flows to keep disruption to a minimum.

Server Security Review

We check relevant security logs and configuration, investigate suspicious activity when you authorise it, and recommend extra controls where needed.

Long-Term Maintenance Planning

We help your team set up a sustainable PHP and Magento upgrade strategy, covering security patching, compatibility testing, backups and deployment planning. See our maintenance plans for ongoing coverage.

Our aim is to close the security gap while keeping your store running smoothly and minimising operational disruption.

Secure Your Magento Store Before an Incident Happens

PHP2Shell is a clear reminder that server-level maintenance is a core part of eCommerce security.

Both vulnerabilities have a critical CVSS score of 9.2. Security reports have documented attack traffic, and researchers have shown remote code execution against affected PHP applications.

Don’t wait for a checkout problem, an unknown admin account or a customer data incident before you look at your server.

Check your PHP version, apply the correct fix, confirm Magento compatibility and review your security monitoring.

Need Help Securing Your Magento Store?

HyvaGo can help you assess your PHP exposure, apply security updates, review Magento compatibility, test checkout and plan upgrades for unsupported environments.

Talk to our team to request a Magento security assessment and agree the right remediation plan for your store.

Contact HyvaGo

Protect your storefront, customer data and business continuity with proactive Magento security maintenance.

FAQs

1. What is PHP2Shell?

PHP2Shell is the name for two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. Attackers can trigger them remotely, without logging in, which can lead to remote code execution.

2. Which PHP versions fix PHP2Shell?

Install PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. PHP 7.4, 8.0 and 8.1 have source backports. PHP 7.0 to 7.3 have no official fix and need an upgrade.

3. Will updating Magento or my extensions fix PHP2Shell?

No. The flaw is in PHP itself, not in Magento, your theme or your extensions. You must update the PHP runtime or apply a trusted vendor backport.

4. Which PHP version should I use for my Magento version?

Magento 2.4.9 should use PHP 8.5.12+. Magento 2.4.8 should use 8.4.27+ or 8.3.36+. Magento 2.4.7 should use 8.3.36+ or 8.2.35+. Magento 2.4.6 should preferably use 8.2.35+.

5. Is Cloudflare WAF enough to protect my store?

No. Cloudflare’s WAF rules add an extra layer of defence, but they don’t replace updating PHP.

Security disclaimer: This blog is based on the advisories and compatibility information available on October 22, 2026. Always check your exact Magento release, deployment type, hosting configuration and the latest vendor guidance before making changes to a production server.