PHP2Shell: patch today, then ask why your store still runs on PHP

On 20 October the PHP security team announced that a release fixing two critical vulnerabilities would follow the next day, and asked everyone running PHP to be ready to update. The fixes arrived on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The two flaws, CVE-2026-109618 and CVE-2026-109619, now known together as PHP2Shell, are both rated 9.2 out of 10.

What makes them serious is where they sit. This is not a plugin or a theme; it is the language underneath the site. According to CERT-EU, a single request from someone with no password can trigger the attack before any of the site's own code runs, and every way of serving PHP on the web is exposed: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers have also shown that the memory of a PHP worker can be read the same way, and that memory holds passwords, tokens and API keys. Qualys reports attack activity seen by Amazon and Cloudflare; CERT-EU reports proofs of concept in circulation.

In plain terms: if your website or e-shop runs on WordPress, WooCommerce, OpenCart, PrestaShop, Magento, Joomla or Drupal, it runs on PHP. Until it is updated, so are your customers' details, your admin passwords and the keys to your payment provider.

So, first, today: find out which PHP version the site runs. Most hosting panels show it on the site's settings page, and your developer or host can tell you in a minute. If it is below the versions above, update it or have it updated. If it is 8.1 or older, it no longer receives regular updates at all; the PHP team published limited backports for 7.4, 8.0 and 8.1, but that is a patch on a version that has already been left behind. If the update cannot happen today, CERT-EU lists stopgaps, such as turning off session upload progress and tightening request limits, and is clear that they do not make a site safe.

Now the uncomfortable part. Updating fixes these two flaws. It does nothing about the reason you will be reading another article like this one next year, and the year after that.

Look at what a typical Greek e-shop actually is. PHP at the bottom. A platform on top of it, often a version its own makers stopped maintaining. A commercial theme last updated years ago. And twenty or thirty plugins for payments, couriers, invoices, myDATA and feeds, each written by someone the owner has never met, each with its own vulnerabilities and its own idea of when to fix them. Ask most owners who is responsible for updating all of that, and the honest answer is nobody in particular. That is not a security model. It is hope, renewed on every patch day.

This week made the point better than we could. Some hosting providers had rules in place on their servers before most of their customers had even heard of PHP2Shell. That is the right thing for a host to do, and it tells you exactly where the protection of most PHP sites really comes from: the luck of having picked a diligent host, not from anyone who owns the site.

At TWENTYONE we have been saying this for a while, though not about PHP by name. In September, in why we stopped building stores on open-source platforms, we described the update trap: patch at once and find out in production what breaks, or wait and run a known vulnerability with a public advisory and a proof of concept attached. Every platform we named in that piece, WooCommerce, Magento, PrestaShop and OpenCart, runs on PHP. Then we argued that the risk lived mostly in plugins and themes. PHP2Shell shows it can live one floor lower, in the runtime every one of those plugins shares, where no amount of careful plugin choice can protect you.

The only lasting way out is the one we have been arguing for: a store whose whole stack has one owner. That is why none of the platforms my team builds runs on PHP. NEXTCOMMERCE, the e-commerce engine behind Topharmakeio.gr and Rellas Jewellery, the TRVL booking platform and its app, Voyage and the TWENTYONE website are written in Node.js, React and Next.js, with PostgreSQL for the data, in one codebase we write, patch and answer for. Payments, couriers, invoices and myDATA are features of that codebase, not plugins with an author and a hope.

No runtime is free of vulnerabilities, and I would not trust anyone who said otherwise. Node.js has them too, and when one appears, we apply the fix across every store at once, on the day, because there is no one else to wait for. That is the whole difference: not a better language, but a short chain of responsibility. On a day like 21 October, the question that matters is not whether your software has flaws. It is who fixes them, how quickly, and how many strangers stand in between.

When we moved Topharmakeio.gr and Rellas off OpenCart this year, their old PHP stores were switched off, not left running in a corner, and their old index.php addresses are now simply redirected by the web server. If your store is a real part of your business, patch PHP today, because you must. Then treat PHP2Shell as the warning it is. The migration guide explains how products, customers, past orders and search rankings come with you.