Critical PHP Security Alert: Immediate Action Required

Two critical remote code execution (RCE) vulnerabilities in PHP could allow attackers to take control of vulnerable web servers without authentication. Magento store owners should review their PHP versions and apply the appropriate security updates immediately.

On October 21, 2026, the PHP security team disclosed two critical vulnerabilities tracked as CVE 2026 109618 and CVE 2026 109619. Both vulnerabilities have a CVSS score of 9.2 out of 10 and are collectively known as PHP2Shell.

The vulnerabilities affect the PHP runtime itself, not a particular eCommerce platform or extension. Security researchers have reported remote code execution and memory disclosure risks across affected PHP environments.

PHP powers a substantial proportion of websites worldwide, making these vulnerabilities relevant to Magento, Adobe Commerce, WordPress, Drupal, and other PHP based applications.

Cloudflare has also reported observing attack traffic targeting its customers and deployed Web Application Firewall protections.

For Magento merchants, a successful attack could expose customer information, compromise website files, disrupt operations, or introduce malicious code into the storefront and checkout.

Important: Updating Magento core, changing your theme, or installing extension updates will not fix these PHP vulnerabilities. You must update the PHP runtime or apply a suitable security backport provided by a trusted vendor.

What Are the PHP2Shell Vulnerabilities?

Both vulnerabilities originate in memory handling within the PHP engine. Under specific conditions, PHP can mishandle internal request data or retain references to memory that has already been released.

An attacker can send specially crafted HTTP requests to trigger these conditions. Depending on the vulnerability and server configuration, successful exploitation may allow remote code execution or sensitive memory disclosure.

CVE 2026 109618: Out of Memory Handling Vulnerability

This vulnerability involves PHP’s handling of out of memory errors.

When PHP encounters certain fatal memory conditions, internal request data may remain partially initialized. During request cleanup, PHP can incorrectly use that data, potentially causing memory corruption and remote code execution.

CVE 2026 109619: Use After Free Vulnerability

This vulnerability involves PHP retaining references to request memory after that memory has been released.

A subsequent request handled by the same PHP worker may encounter stale state before normal initialization resets it. Under the relevant conditions, this can lead to memory corruption and potentially remote code execution.

Why Are These Vulnerabilities So Serious?

Both vulnerabilities can be triggered remotely without requiring the attacker to authenticate first.

Because the underlying defects exist in PHP itself, applications can remain vulnerable even when their application code, Magento installation, and extensions are fully updated.

Researchers have also demonstrated exploitation against other PHP based applications.

Magento merchants should therefore treat this as a server level security issue, not simply an application maintenance task.

Affected PHP Versions and Security Fixes

The PHP security team has released fixed versions for the affected supported branches. Older branches require a different remediation approach because many have reached end of life.

What If Your Store Uses PHP 7.4, 8.0, or 8.1?

The PHP project has published source backports for these older branches. Some hosting providers and software distributors may also offer patched builds.

However, a source backport is not the same as a standard, maintained PHP release. Verify that your hosting provider has applied the correct fix to the exact PHP package serving your website.

PHP 7.0 through 7.3 have no official fixes listed in the advisory table above. These environments require an upgrade to a supported PHP branch or another verified remediation option where available.

Our recommendation: Do not leave an internet facing Magento store on an unsupported PHP version without verified mitigation and a defined upgrade plan.

Magento Version Compatibility: Which PHP Version Should You Use?

Applying the PHP security patch is essential, but you must first confirm that your Magento or Adobe Commerce version supports the PHP version you intend to install.

Not every Magento release supports every PHP branch. Moving directly to PHP 8.5, for example, is not an appropriate solution for every Magento installation.

According to Adobe’s published system requirements available on October 22, 2026, the following combinations are relevant to this security alert.

Magento and PHP Compatibility Matrix

The table shows PHP compatibility for the specified Magento release lines. It does not mean every historical patch release supports the same combination. Check the exact installed Magento patch level before making changes.

Magento 2.4.9

Magento Open Source and Adobe Commerce 2.4.9 support PHP 8.5.

For this release, the appropriate PHP security update is PHP 8.5.12 or later.

Do not downgrade an installation that already uses Magento 2.4.9 simply to match an older PHP branch. Instead, bring the PHP runtime up to the fixed release supported by Magento.

Magento 2.4.8

Magento 2.4.8 supports PHP 8.4 and PHP 8.3 in its latest published patch line.

For this version, apply the corresponding PHP security update:

1. PHP 8.4.27 or later.
2. PHP 8.3.36 or later.

Do not switch a Magento 2.4.8 production environment to PHP 8.5 without an official compatibility confirmation for that exact release. PHP 8.5 support is associated with Magento 2.4.9.

Magento 2.4.7

The latest published Magento 2.4.7 patch line supports PHP 8.3 and PHP 8.2.

You can generally address this PHP vulnerability without changing the minor PHP branch by installing:

1. PHP 8.3.36 or later.
2. PHP 8.2.35 or later.

A PHP patch update still requires appropriate staging and production testing.

Magento 2.4.6

The latest published Magento 2.4.6 patch line supports PHP 8.2 and PHP 8.1.

PHP 8.2.35 or later is the preferred remediation path when your installation and dependencies support it.

If your store runs PHP 8.1, the compatibility matrix alone does not establish that the runtime is secure. PHP 8.1 requires a verified vendor provided security backport or a planned upgrade to a supported PHP branch.

Magento 2.4.5 and Older Releases

Older Magento releases may be tied to PHP branches that no longer receive standard upstream security fixes.

For these installations, you need to assess both the PHP vulnerability and the broader security status of the Magento application.

Depending on the starting version, remediation may require a staged Magento upgrade, extension replacements, custom code changes, and hosting adjustments.

Do not treat an unsupported combination as secure simply because the storefront still works.

What Should You Do If Your Magento and PHP Versions Are Incompatible?

Follow this process:

1. Identify the exact Magento version and security patch level.
2. Confirm the PHP runtime serving public web requests.
3. Check Adobe’s system requirements and your hosting provider’s supported packages.
4. Select the fixed PHP branch supported by your Magento version.
5. Review third party extensions, custom modules, and Composer dependencies.
6. Test the storefront, admin panel, checkout, payments, and background jobs.
7. Deploy with backups, monitoring, and a rollback plan.

If no suitable patched runtime is available for your existing environment, plan a controlled platform upgrade or another verified mitigation with your hosting provider.

Do not delay a security assessment simply because you need time to plan a full Magento upgrade. Apply the safest available mitigation first, then complete the longer term upgrade.

What Could This Mean for Your Magento Store?

A successful PHP level compromise could have significant commercial and operational consequences.

Customer data exposure

An attacker who gains sufficient access may access customer records, order information, application secrets, or other sensitive data.

Checkout compromise

Attackers may attempt to modify storefront scripts or checkout components to capture customer information or interfere with payment processing.

Malicious files and website defacement

Attackers may change page content, inject malicious scripts, or place malicious files on a compromised server.

Business disruption

A server compromise may interrupt shopping, order processing, integrations, and fulfilment workflows.

Recovery and compliance costs

Investigating an incident, restoring clean systems, protecting affected customers, and meeting applicable reporting obligations can add significant costs.

These are potential impacts of successful exploitation. A vulnerable PHP version does not automatically mean that your store has already been compromised.

How to Protect Your Magento Store?

Follow these steps to reduce your exposure.

Step 1: Identify the PHP Runtime Serving Your Website

Check the PHP version used by your live Magento storefront.

Your command line PHP version may differ from the version used by PHP FPM, Apache, or another web server handler.

Confirm the runtime that actually processes public web requests. Also check staging environments, background services, containers, and other PHP applications running on the same infrastructure.

Step 2: Apply the Security Update

For supported PHP branches, install the appropriate fixed release.

For older branches, ask your hosting provider to confirm whether a suitable patched package or trusted source backport is available.

If you use managed hosting, request confirmation that the patch has been applied to the active PHP runtime, not merely made available in the control panel.

Step 3: Check Magento and Extension Compatibility

Before changing PHP minor branches, review:

1. Your Magento or Adobe Commerce version.
2. Your theme and custom modules.
3. Third party extensions and Composer dependencies.
4. PHP extensions and server configuration.
5. Payment gateways and external integrations.

Plan the change carefully when upgrading from an unsupported PHP branch.

Step 4: Test Your Store After the Update

Use staging where practical, maintain a rollback plan, and validate essential business functions.

Test the homepage, category pages, product pages, customer accounts, cart, shipping, discounts, checkout, payment gateway, admin panel, cron jobs, message queues, and external integrations.

Review PHP and application logs for new errors. Confirm that the live website is running the patched PHP version after deployment.

Step 5: Enable Additional Security Protection

Cloudflare has deployed PHP2Shell related WAF protections for customers using its managed WAF rulesets.

Keep appropriate protections enabled and review security events for suspicious requests. Confirm that the relevant rules are enabled in blocking mode where your plan supports this configuration.

Cloudflare protection provides an additional layer of defence. It does not replace updating PHP.

If you cannot patch immediately, follow official guidance for temporary mitigations and assess whether you should restrict or disable the vulnerable service until a safe fix is available.

If you suspect a successful attack, arrange a security investigation rather than assuming that installing the patch alone will remove an existing compromise.

Why Is Updating Magento Extensions Not Enough?

These vulnerabilities affect the PHP language runtime rather than Magento core, a particular theme, or a specific extension vendor.

Updating Magento and third party modules remains essential for overall security. However, it does not correct a vulnerable PHP installation.

For example, a Magento store running a fully patched application on PHP 8.3.20 would still require the PHP runtime security update to at least PHP 8.3.36.

The correct remediation is to update the PHP runtime, confirm that the fix is active, and test the application afterwards.

How RiseCommerce Can Help?

RiseCommerce provides Magento and Adobe Commerce development, maintenance, performance optimisation, and server support.

Our developers and DevOps engineers can help your business respond to PHP2Shell with a controlled remediation process.

PHP Security Assessment

We identify the PHP version running your website, review the server configuration, and determine the appropriate security fix.

PHP Security Patch and Upgrade

We help apply the relevant PHP patch or coordinate with your hosting provider. If your current branch has no suitable fix, we plan an upgrade to a supported version.

Magento Compatibility Review

We review Magento core, themes, third party extensions, custom modules, Composer dependencies, and PHP extensions before changing PHP versions.

Checkout and Functional Testing

We validate critical shopping and order processing workflows after remediation to reduce the risk of disruption.

Server Security Review

We review relevant security logs and configuration, investigate suspicious activity when authorised, and recommend additional controls where necessary.

Long Term Maintenance Planning

We help your team establish a sustainable PHP and Magento upgrade strategy, including security patching, compatibility testing, backups, and deployment planning.

Our goal is to help you close the security gap while preserving store functionality and minimising operational disruption.

Secure Your Magento Store Before an Incident Occurs

The PHP2Shell vulnerabilities demonstrate why server level maintenance is essential for eCommerce security.

Both vulnerabilities carry a critical CVSS score of 9.2. Security reporting has documented attack traffic, while researchers have demonstrated remote code execution against affected PHP applications.

Do not wait for a checkout issue, suspicious administrator account, or customer data incident before investigating your server.

Check your PHP version, apply the correct fix, validate your Magento compatibility, and review your security monitoring.

Need Help Securing Your Magento Store?

RiseCommerce can help you assess PHP exposure, implement security updates, review Magento compatibility, test checkout functionality, and plan upgrades for unsupported environments.

Contact our team to request a Magento security assessment and discuss the right remediation plan for your store.

Contact RiseCommerce

Protect your storefront, customer data, and business continuity with proactive Magento security maintenance.

Security disclaimer: This article reflects the advisories and compatibility information available on October 22, 2026. Verify the exact Magento release, deployment type, hosting configuration, and latest vendor guidance before making changes to your production server.