Critical PHP vulnerability / Magento, Adobe Commerce, WooCommerce and every PHP storefront
PHP2Shell hits the server under every Magento and WooCommerce store.
PHP2Shell is the name for two critical remote code execution flaws in PHP itself: CVE-2026-109618 and CVE-2026-109619. Sansec says every web server running PHP 5.4 or later is affected. PHP scheduled the fix for 21 October at 14:00 UTC, and Sansec expects mass attacks within 15 minutes of the release. Patching PHP closes the door. It does not tell you what came through before you closed it.
Request the scanAnswered within five business hours, Mon to Fri, Eastern
Free compromise scan
Run by a listed Sansec partner. No cost, no obligation to continue.
Answered within five business hours, Monday to Friday, Eastern. We never ask for credentials by email.
Why the PHP patch is not the end of it
The flaw sits in the PHP interpreter, not in Magento or WordPress code. No extension update or application patch fixes it. Only a new PHP runtime does, and even that only protects you from the moment it is running.
Details leaked before the fix
Details leaked on 20 October, before the coordinated release. Any server attacked between the leak and your upgrade can already carry a backdoor. Upgrading PHP does not remove files an attacker wrote while the hole was open.
The CLI is not the web server
Running php -v in a terminal shows the command line binary. Your storefront runs through PHP-FPM or an Apache module, which can be a different version. A store can look patched from the shell and still serve traffic on the old runtime until PHP-FPM restarts.
PHP 8.1 and older get no fix
PHP is fixing its supported branches, 8.2 to 8.5. PHP 8.1, 7.x and 5.x are end of life. Many older Magento 2 and WooCommerce stores still run them, and moving to PHP 8.2 or later can mean upgrading the platform first.
Which stores are exposed, by platform
Exposure depends on one question: does PHP run on a server you control, reachable from the internet? If yes, your store is in scope, whatever sits on top of it.
Magento Open Source and Adobe Commerce
Every Magento 2 store runs on PHP, so every self-hosted install is in scope. A compromised PHP process can read app/etc/env.php, your database credentials, customer data and payment settings, and inject a skimmer into checkout.
WooCommerce and WordPress
WooCommerce runs on WordPress, which runs on PHP. Every self-hosted WooCommerce store is in scope, as is any WordPress blog on the same server as another store. Managed WordPress hosts upgrade PHP on their own schedule: confirm with yours, do not assume.
Adobe Commerce on cloud
Your PHP version is set in your project configuration. Check which version each environment runs, including staging, and confirm with Adobe when the patched runtime reaches your project.
Shopify and BigCommerce
The storefront itself runs on the platform's servers, not on yours. The risk applies to anything PHP you host beside it: a WordPress blog, a headless front end, an ERP or PIM connector, a custom app. Those are worth checking.
What the free scan actually is
A short call, a forensic scan of your store, and a written finding. Three steps, no charge, and no obligation to buy anything at the end of it.
A fifteen minute call
We confirm your platform, the PHP version your web server actually runs, when it was upgraded, and who your technical contact is. You talk to a developer, not a sales queue.
eComscan on your store
eComscan is the forensic scanner built by Sansec, the firm that published the PHP2Shell alert. We run it as a listed Sansec partner and look for backdoors, web shells, unknown PHP files, injected skimmers and rogue admin accounts.
A written finding
What we found, what it means, and what remediation would cost. If the store is clean, you have it in writing and there is nothing to pay.
How to check your Magento or WooCommerce server for PHP2Shell yourself
Run these on production. If a check returns something you cannot explain, stop and request the scan.
- Check the version the web server runs, not the shell:
php-fpm8.3 -v(adjust to your version), or list running pools withps aux | grep php-fpm. - After upgrading, restart PHP-FPM so the new runtime serves traffic:
sudo systemctl restart php8.3-fpm, then check the version again. - Look for PHP files that should not exist in Magento media and static folders:
find pub/media pub/static -name "*.php*". - Do the same in WordPress uploads:
find wp-content/uploads -name "*.php*". - List PHP files changed since the leak:
find . -name "*.php" -newermt "2026-10-20" -not -path "./var/*" -not -path "./generated/*". - Look for PHP-FPM workers running shells or download tools:
ps -ef --forest | grep -A3 php-fpm, then look forsh,bash,curlorwgetunder them. - Review the web user's crontab (
crontab -l -u www-data),~/.ssh/authorized_keys, and new Magento or WordPress admin accounts created since 20 October.
What we need from you, before you have to ask
eComscan runs on the server, so the scan needs temporary SSH access to your production environment. That is a real ask, and we would rather put it on this page than spring it on you in the call.
How we take it
- A limited user, not root
- Shared through a password manager, never by email
- Time-boxed and revoked after the scan
- Revocation confirmed in writing
- Mutual NDA signed beforehand
Or give us nothing at all
If you would rather not grant access, we walk your own sysadmin through the scan on a screen share. No credentials change hands.
On Shopify and BigCommerce there is no store server to access: we review the PHP sites and connectors you host beside the store instead.
Sansec lists us. That is not a badge we made ourselves.
Sansec is the security firm that published the PHP2Shell alert. Their partner directory describes what we do in their words, not ours: managed Sansec security, eComscan, Shield deployment, alert handling, and malware removal for compromised stores.
View our listing on sansec.ioQuestions merchants are asking this week
What is PHP2Shell?
PHP2Shell is the name given to two critical remote code execution vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on CVSS v4.0. Details leaked on 20 October 2026, before the coordinated release. PHP scheduled fixed releases for 21 October 2026 at 14:00 UTC. Sansec says all web servers running PHP 5.4 or later are affected.
Which PHP versions are affected and which are fixed?
Sansec says PHP 5.4 and later are affected. PHP is releasing fixes for its supported branches, 8.2, 8.3, 8.4 and 8.5. PHP 8.1, 7.x and 5.x are end of life and get no official fix. Check php.net for the exact fixed version on your branch.
Is my Magento or Adobe Commerce store affected?
If it runs on a server you or your host manage, yes, until that server runs a fixed PHP release. Magento code itself is not the flaw, so no Magento patch or extension update closes it. Upgrade PHP, restart PHP-FPM, then check for anything written to the server before the upgrade.
Is my WooCommerce store affected?
Yes, if it is self-hosted. WooCommerce runs on WordPress, which runs on PHP. Updating WordPress or WooCommerce does not update PHP: that comes from your server packages or your host.
We are on Shopify or BigCommerce. Does this apply?
Not to the storefront itself, which runs on the platform's servers. It applies to any PHP you host beside it: a WordPress blog, a headless front end, or an integration server connected to your store.
Does turning off session.upload_progress protect us?
Not reliably. Setting session.upload_progress.enabled = 0 is widely shared as a stopgap, but PHP has not confirmed it as a mitigation and researchers expect bypasses. Treat it as a temporary measure at most. Upgrading PHP is the fix.
Our store runs PHP 8.1 or older. What now?
There is no official PHP fix for your branch. Plan the move to PHP 8.2 or later, which may require a platform upgrade first, and limit public exposure until it is done. The scan tells you whether the server was already compromised before you migrate.
Does the scan really cost nothing?
Yes. The call, the scan and the written finding are free. Remediation is quoted separately, after you have seen what was found, and you are free to take that finding to anyone.
Source: Sansec Forensics Team, Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619, 21 October 2026. CVSS scores from the PHP security announcement.
The patch closes the door. Find out whether anyone came through first.
Free scan. Written finding. Answered within five business hours, Monday to Friday, Eastern.
Request the scan450-628-0690