The PHP Bug That Put Online Stores at Risk: What Changed and What to Do

PHP2Shell is the name security researchers gave to two memory-safety flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 on severity. A crafted web request could trigger them without a password, letting an attacker run their own code on the server behind the scenes. PHP's maintainers fixed both at 14:00 UTC on 21 October 2026, and by Cloudflare's count, exploit attempts went from thousands in the hours before the patch to millions within the day after. Because the flaw sits in the PHP engine rather than in any single shopping cart, it reached further than a typical plugin bug. (If you are not sure your store's back end is being kept current with fixes like this one, that is exactly the kind of ongoing work a developer who can keep your store patched and secure takes off your plate.)

Who Was Actually Exposed

The honest answer splits sellers into two very different groups, and which one you are in depends on how your store is hosted, not which shopping cart software you use:

• Fully hosted platforms — Shopify, Wix and Squarespace stores had nothing for the store owner to patch. The platform itself controls the server and PHP version, so this was handled on their end, not yours.
• Self-hosted stores on PHP — WooCommerce, Magento (Adobe Commerce) and other stores running on your own server or a general web host were exposed even when your own store code was clean, because the hole was in the PHP engine underneath it, not in WooCommerce or Magento themselves.

Why This Caught So Many Stores Off Guard

A plugin vulnerability usually has a known fix: update the plugin. This one was different because the flaw was in PHP itself, the language the store software runs on. WooCommerce and Magento had no patch to release, because there was nothing wrong with their code, the fix had to come from updating the underlying PHP version on the server, something most home-based sellers never think about and many hosts handle silently, but not all of them do it automatically or quickly.

What To Actually Check This Week

• If your store runs on Shopify, Wix or Squarespace, there is genuinely nothing to do here, the platform handled it.
• If you run WooCommerce or Magento on a VPS, dedicated server, or a host where you manage updates yourself, check what PHP version your server is running and confirm it is at least 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the versions PHP shipped the fix in.
• If you run WooCommerce through a managed WordPress host (the kind built specifically for WooCommerce, not a general shared host), most of these pushed the PHP update automatically in the days after 21 October, it is still worth confirming rather than assuming.
• If you genuinely do not know how to check your server's PHP version, that uncertainty is itself the signal that your store's technical side could use a second pair of eyes.

The Honest Caveats

A few things worth knowing before you panic or relax too fast:

• Having an old PHP version does not mean you were definitely attacked, it means the door was unlocked, not that someone necessarily walked through it.
• This is not a one-time fix you do and forget. PHP engine flaws like this one are rare but not unheard of, and the sellers best protected going forward are the ones whose hosting keeps PHP current as a matter of routine, not as a scramble after a headline.
• If you are not sure whether your host already handled this, a quick message to their support asking "what PHP version are we running, and was PHP2Shell patched" is a completely reasonable thing to ask, and a good host will answer it plainly.

None of this requires panic, most sellers on mainstream hosting were covered within days. But if reading this is the first time you have thought about what PHP version your store runs on, that is worth fixing properly rather than letting it sit until the next scare. Take a look at how our done-for-you packages and coaching work if you would rather hand the technical upkeep to someone else and get back to running your business.