{"id":3168,"date":"2026-10-22T09:42:13","date_gmt":"2026-10-22T09:42:13","guid":{"rendered":"https:\/\/hyvago.com\/blog\/?p=3168"},"modified":"2026-11-06T07:03:25","modified_gmt":"2026-11-06T07:03:25","slug":"critical-php-security-alert-magento-php2shell","status":"publish","type":"post","link":"https:\/\/hyvago.com\/blog\/critical-php-security-alert-magento-php2shell\/","title":{"rendered":"Critical PHP2Shell Alert: Secure Your Magento Store | HyvaGo"},"content":{"rendered":"\n

Critical PHP Security Alert: Act Now to Protect Your Store<\/h2>\n\n\n\n
\"php2shell\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

PHP has two newly disclosed critical remote code execution (RCE) vulnerabilities that could let an attacker take over an exposed web server without logging in. If you run a Magento store, check your PHP version now and install the right security update without delay.<\/p>\n\n\n\n

The PHP security team announced the two flaws on October 21, 2026. They are tracked as CVE-2026-109618 and CVE-2026-109619, each carries a CVSS score of 9.2 out of 10, and together they are referred to as PHP2Shell.<\/p>\n\n\n\n

The problem lives in the PHP runtime itself. It is not tied to one eCommerce platform or extension. Researchers have reported both remote code execution and memory disclosure risks in affected PHP environments.<\/p>\n\n\n\n

PHP runs a large share of the world’s websites, so these flaws matter for Magento, Adobe Commerce, WordPress, Drupal and any other PHP-based application.<\/p>\n\n\n\n

Cloudflare has said it is seeing attack traffic aimed at its customers and has rolled out Web Application Firewall protections in response.<\/p>\n\n\n\n

For Magento merchants, a successful attack could leak customer data, compromise site files, disrupt day-to-day operations, or plant malicious code in the storefront and checkout.<\/p>\n\n\n\n

Important: Upgrading Magento core, switching themes or updating extensions will not close these PHP vulnerabilities. The fix is to update the PHP runtime or install a suitable security backport from a trusted vendor.<\/p>\n\n\n\n

What Are the PHP2Shell Vulnerabilities?<\/h2>\n\n\n\n

Both flaws come from the way the PHP engine handles memory. In certain conditions, PHP can mishandle internal request data or keep pointing to memory that has already been freed.<\/p>\n\n\n\n

An attacker can trigger these conditions with carefully crafted HTTP requests. Depending on which flaw is hit and how the server is configured, the result can be remote code execution or exposure of sensitive memory.<\/p>\n\n\n\n

CVE-2026-109618: Out-of-Memory Handling Vulnerability<\/h3>\n\n\n\n

This flaw relates to how PHP deals with out-of-memory errors.<\/p>\n\n\n\n

When PHP hits certain fatal memory conditions, internal request data can be left only partly initialised. During request cleanup, PHP may then use that data incorrectly, which can corrupt memory and open the door to remote code execution.<\/p>\n\n\n\n

CVE-2026-109619: Use-After-Free Vulnerability<\/h3>\n\n\n\n

This flaw relates to PHP holding on to references to request memory after that memory has been freed.<\/p>\n\n\n\n

The next request handled by the same PHP worker can run into this leftover state before normal initialisation clears it. Under the right conditions, this can corrupt memory and potentially lead to remote code execution.<\/p>\n\n\n\n

Why Are These Vulnerabilities So Serious?<\/h3>\n\n\n\n

Attackers can trigger both flaws remotely, with no authentication required.<\/p>\n\n\n\n

Because the defects sit inside PHP, a site can stay vulnerable even when its application code, Magento installation and extensions are all fully up to date.<\/p>\n\n\n\n

Researchers have also shown working exploits against other PHP-based applications.<\/p>\n\n\n\n

Magento merchants should treat this as a server-level security problem, not just routine application maintenance.<\/p>\n\n\n\n

Affected PHP Versions and Security Fixes<\/h2>\n\n\n\n

The PHP security team has shipped fixed releases for the supported branches that are affected. Older branches need a different approach, as many of them are past the end of life.<\/p>\n\n\n\n

\n

PHP version<\/p>\n<\/td>

\n

Vulnerable versions<\/p>\n<\/td>

\n

Fixed version or remediation<\/p>\n<\/td><\/tr>

\n

PHP 7.0<\/p>\n<\/td>

\n

All 7.0.x versions<\/p>\n<\/td>

\n

No official fix<\/p>\n<\/td><\/tr>

\n

PHP 7.1<\/p>\n<\/td>

\n

All 7.1.x versions<\/p>\n<\/td>

\n

No official fix<\/p>\n<\/td><\/tr>

\n

PHP 7.2<\/p>\n<\/td>

\n

All 7.2.x versions<\/p>\n<\/td>

\n

No official fix<\/p>\n<\/td><\/tr>

\n

PHP 7.3<\/p>\n<\/td>

\n

All 7.3.x versions<\/p>\n<\/td>

\n

No official fix<\/p>\n<\/td><\/tr>

\n

PHP 7.4<\/p>\n<\/td>

\n

All 7.4.x versions<\/p>\n<\/td>

\n

Source backport available<\/p>\n<\/td><\/tr>

\n

PHP 8.0<\/p>\n<\/td>

\n

All 8.0.x versions<\/p>\n<\/td>

\n

Source backport available<\/p>\n<\/td><\/tr>

\n

PHP 8.1<\/p>\n<\/td>

\n

All 8.1.x versions<\/p>\n<\/td>

\n

Source backport available<\/p>\n<\/td><\/tr>

\n

PHP 8.2<\/p>\n<\/td>

\n

8.2.0 to 8.2.34<\/p>\n<\/td>

\n

8.2.35 or later<\/p>\n<\/td><\/tr>

\n

PHP 8.3<\/p>\n<\/td>

\n

8.3.0 to 8.3.35<\/p>\n<\/td>

\n

8.3.36 or later<\/p>\n<\/td><\/tr>

\n

PHP 8.4<\/p>\n<\/td>

\n

8.4.0 to 8.4.26<\/p>\n<\/td>

\n

8.4.27 or later<\/p>\n<\/td><\/tr>

\n

PHP 8.5<\/p>\n<\/td>

\n

8.5.0 to 8.5.11<\/p>\n<\/td>

\n

8.5.12 or later<\/p>\n<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What If Your Store Runs PHP 7.4, 8.0 or 8.1?<\/h3>\n\n\n\n

The PHP project has released source backports for these older branches, and some hosting providers and software distributors may also ship patched builds.<\/p>\n\n\n\n

Keep in mind that a source backport is not the same thing as a regular, maintained PHP release. Make sure your host has applied the correct fix to the exact PHP package that serves your site.<\/p>\n\n\n\n

The advisory table above lists no official fix for PHP 7.0 through 7.3. Stores on these versions need to move to a supported PHP branch, or use another verified remediation where one exists.<\/p>\n\n\n\n

Our recommendation: Don’t leave a public-facing Magento store on an unsupported PHP version unless you have verified mitigation in place and a clear upgrade plan.<\/p>\n\n\n\n

Magento Version Compatibility: Which PHP Version Is Right for You?<\/h2>\n\n\n\n

Installing the PHP security patch is essential, but first make sure your Magento or Adobe Commerce version actually supports the PHP version you plan to use.<\/p>\n\n\n\n

Each Magento release supports only certain PHP branches. Jumping straight to PHP 8.5, for instance, is not the right answer for every installation.<\/p>\n\n\n\n

Based on Adobe’s system requirements published as of October 22, 2026, these are the combinations that matter for this alert.<\/p>\n\n\n\n

Magento and PHP Compatibility Matrix<\/h3>\n\n\n\n

 <\/b><\/p>\n\n\n\n

\n

Magento Open Source \/ Adobe Commerce release<\/p>\n<\/td>

\n

Tested PHP branches<\/p>\n<\/td>

\n

Recommended action<\/p>\n<\/td><\/tr>

\n

2.4.9<\/p>\n<\/td>

\n

PHP 8.5<\/p>\n<\/td>

\n

Use PHP 8.5.12 or later<\/p>\n<\/td><\/tr>

\n

2.4.8-p5<\/p>\n<\/td>

\n

PHP 8.4 and 8.3<\/p>\n<\/td>

\n

Use PHP 8.4.27 or later, or PHP 8.3.36 or later<\/p>\n<\/td><\/tr>

\n

2.4.7-p10<\/p>\n<\/td>

\n

PHP 8.3 and 8.2<\/p>\n<\/td>

\n

Use PHP 8.3.36 or later, or PHP 8.2.35 or later<\/p>\n<\/td><\/tr>

\n

2.4.6-p15<\/p>\n<\/td>

\n

PHP 8.2 and 8.1<\/p>\n<\/td>

\n

Prefer PHP 8.2.35 or later; PHP 8.1 requires a verified vendor backport<\/p>\n<\/td><\/tr>

\n

2.4.5-p17 and earlier legacy releases<\/p>\n<\/td>

\n

Check the exact release requirements<\/p>\n<\/td>

\n

Review vendor support, security fixes, and a migration path<\/p>\n<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

This table covers PHP compatibility for the listed Magento release lines only. It does not mean every older patch release supports the same combination, so confirm your exact installed patch level before making any changes.<\/h4>\n\n\n\n

Magento 2.4.9<\/h3>\n\n\n\n

Magento Open Source and Adobe Commerce 2.4.9 support PHP 8.5.<\/p>\n\n\n\n

The correct security update for this release is PHP 8.5.12 or later.<\/p>\n\n\n\n

If you are already on Magento 2.4.9, don’t downgrade just to match an older PHP branch. Update the PHP runtime to the fixed release that Magento supports.<\/p>\n\n\n\n

Magento 2.4.8<\/h3>\n\n\n\n

The latest published patch line of Magento 2.4.8 supports PHP 8.4 and PHP 8.3.<\/p>\n\n\n\n

Install the matching PHP security update for this version:<\/p>\n\n\n\n