php2shell: what Magento and PHP stores should do now

On 21 October 2026 the PHP project shipped emergency releases for two critical flaws, now known as php2shell. They are in PHP itself, not in Magento, WordPress or any plugin, and they can let an attacker run code on a server without logging in. If your store runs on PHP, this one is yours too.

What php2shell is

• CVE-2026-109618, “RCE via OOM corruption”: when PHP runs out of memory while it is still reading a request, its cleanup can treat half-built data as valid.
• CVE-2026-109619, “RCE via stale global state”: a PHP worker can reuse leftover state from an earlier request.

Both are rated 9.2 (CVSS 4.0). PHP reads the request before your application code runs, so a login screen or a rule inside Magento does not stop it. The PHP project says every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest risk.

It is already being exploited

• On 26 October, CISA added both flaws to its catalogue of known exploited vulnerabilities.
• Amazon reported attempts on its honeypots, and Cloudflare reported early attacks on the day of the release.
• Trail of Bits confirmed working exploits against unpatched PHP 8.2 to 8.5.

The fixed PHP versions

• PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026.
• PHP 8.1 and older get no official release. The PHP project published minimal source patches for 7.4, 8.0 and 8.1; there you depend on your Linux distribution or host, or you move to a supported version.
• Magento 2.4.9 runs on PHP 8.5, so it needs 8.5.12. Magento 2.4.8 runs on PHP 8.3 or 8.4: 8.3.36 or 8.4.27. Magento 2.4.6 and 2.4.7 can run on PHP 8.2: 8.2.35, or 8.3.36 on 2.4.7.
• PHP 8.2 reaches end of life on 31 December 2026, so a store on 8.2 should plan its next step now.

There is no Magento patch for php2shell. The fix is the PHP update, on every server that runs your store, staging included.

What to do, in order

1. 01Find out which PHP version your web server runs, not only the command line, because the two can differ. Your hosting panel shows it, or ask your host for the exact package version in writing.
2. 02Update PHP to the fixed release for your version, on staging first, then live.
3. 03Restart every PHP process: PHP-FPM or Apache, queue consumers and cron. A new package does not patch processes that are already running.
4. 04Turn off session upload progress (session.upload_progress.enabled = 0). PHP advises this until its next bugfix release, for a related issue (CVE-2026-115560).
5. 05Make sure only your CDN or firewall can reach the server. Cloudflare deployed rules for the known attacks, on the free plan too, but they only help if direct requests to your server’s IP address are blocked.
6. 06Watch your logs after the update. PHP confirmed a regression in 8.4.27 and 8.5.12 that can crash PHP in some applications that use SimpleXML (php-src issue 24488). A fix is merged, but when we checked on 27 October it was not in a release yet.
7. 07If your server was reachable and unpatched, look for signs of a break-in: new PHP files in pub or media folders, files that are not in Git, and admin users, cron jobs or CMS blocks you did not create. If you find any, change passwords and keys.

The update is the fix. The restart is what makes it real.

What we did on our own store

Our demo store, Neaterie, runs Magento 2.4.9 on PHP 8.5. On the morning of 21 October, before the fixed versions were out, we locked the server so that only Cloudflare can reach it: a direct request to the server’s IP address gets a 403 from nginx before PHP runs. We turned off session upload progress the same day, and that evening we rebuilt the PHP image on 8.5.12 and restarted every PHP process. So far we have seen no PHP crashes.

Where to start

If you are not sure which PHP version your store runs, or whether your host has updated it, our free audit checks your PHP and Magento versions, missing patches and the signs above, and tells you what to fix first.

Sources: the PHP security advisory and release notes on php.net (21 and 23 October 2026), Tenable’s php2shell FAQ (updated 26 October) and Datadog Security Labs’ analysis (updated 23 October), checked on 27 October 2026.