PHP2Shell and PrestaShop: the critical PHP flaw and what to do

PHP2Shell is the name given to two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. A single crafted request can be enough to take over a store’s server, with no login and no password. They affect every PrestaShop store, whatever its version or modules, because the bug is in PHP, the engine PrestaShop runs on, not in PrestaShop itself. The only complete fix is updating PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Older stores have the hardest time: PrestaShop 1.6, 1.7 and 8 run on PHP versions that no longer get official fixes from the PHP project. This guide explains the flaw in plain English, how to check your store and what to do, step by step.

What is PHP2Shell?

PHP is the language and engine that runs PrestaShop on the server: it builds the pages, saves orders and sends emails. If your store were a shop in a mall, PHP would be the lock on the main entrance of the whole building. In October 2026 it turned out that this lock could be opened without a key.

The PHP team described two bugs, both rated 9.2 out of 10 on the CVSS scale, which is critical:

• CVE-2026-109618: when PHP runs out of memory while reading a submitted form, it can leave half-built data behind, and an attacker can exploit that mess.
• CVE-2026-109619: leftovers from one request stay in the server’s memory, and the next request handled by the same process can use them. The easiest route goes through the file upload progress feature (session upload progress), which PHP enables by default.

Both lead to remote code execution (RCE): an attacker runs any program they like on your server before PrestaShop even starts. A leak made things worse, as the details and a tool called “PHP2Shell” were circulating online a day before the fixes came out.

Why does a PHP flaw affect every PrestaShop store?

Most of the vulnerabilities covered in our PrestaShop security guide sit in specific modules or store versions, and updating the module fixes them. PHP2Shell is different. The attack happens while the server is reading the incoming request, before any PrestaShop code runs. That is why updating PrestaShop or its modules will not help, as PrestaShop’s own guidance for merchants also confirms. The patch has to go on the server.

Nor can a store simply “switch off forms”. PrestaShop uses file uploads in many places: the contact form with attachments, product customisation, CSV imports, product images and module installation in the back office. Blocking those requests would break the store.

What can an attacker do once they control the server? Anything an administrator can: copy the customer database with addresses and phone numbers, swap the payment page for a fake one, inject malicious code for visitors, send spam from the store’s domain, or encrypt your files and demand a ransom. If personal data leaks, you also have legal duties towards your customers and your data protection authority.

Older PrestaShop versions: where the real problem is

Each PrestaShop version only works with certain PHP versions, and the PHP project only supports its latest few branches. PHP 8.1 and older no longer get official releases. As an exception, the PHP team published a minimal source patch for PHP 7.4, 8.0 and 8.1, but whether it reaches your server depends on whoever builds PHP packages for it, such as your Linux distribution or your hosting company.

The minimal patch closes the known attack routes in a blunt way: when PHP runs out of memory, the process is killed at once, and upload progress is switched off for good. It works, but the PHP team itself calls it the minimum for unsupported versions, and the next similar flaw may not get one at all. On top of that, PHP 8.2 reaches end of life on 31 December 2026, so in two months more servers will join this group.

The takeaway is simple: a store on PrestaShop 1.7 or 8 can still be patched today, but it gets harder every month. The safe path is an upgrade to PrestaShop 9, which runs on supported PHP.

How do you check your store’s PHP version?

In the PrestaShop 1.7, 8 and 9 back office, go to Advanced Parameters → Information. The server information section shows the PHP version. Note that the number alone doesn’t tell the whole story. Packages with a backported patch often keep the same version number as before (for example 7.4.33 or 8.1.34) and only differ in an internal package revision. So with older PHP, always ask whoever looks after the server whether the patch is installed.

Shared hosting or your own server: who installs the patch?

It depends on where your store runs. We compare the options in detail in VPS or shared hosting for PrestaShop.

• Shared hosting: your hosting company updates PHP, and you have no say in it. Older PHP versions offered in the hosting panel don’t always get patches. Ask your host in writing: “Has the fix for CVE-2026-109618 and CVE-2026-109619 been applied to the PHP version running my store?” PrestaShop recommends the same.
• Your own VPS or dedicated server: the administrator installs the patch, which means you or the company managing the server. Nobody does it automatically, because popular third-party PHP package sources for Ubuntu are not covered by automatic system updates by default.
• Managed server: security updates, PHP included, are the administrator’s job as part of the service.

What to do now: 6 steps

1. Check your PHP version in Advanced Parameters → Information.
2. Ask your host or administrator whether the patch is installed, and ask for the answer in writing.
3. On your own server, update PHP and restart every PHP process (PHP-FPM, Apache). Installing the packages is not enough, because running processes keep using the old code.
4. If you can’t update right away, turn off upload progress in php.ini or the PHP-FPM pool configuration (not in .user.ini or with ini_set(), where it has no effect). PrestaShop doesn’t use this feature, so nothing breaks. This workaround only closes some of the attack routes.
5. Check for signs of a break-in: new .php files in the store folders, unknown accounts in Advanced Parameters → Team, modified payment modules, new cron jobs. Our security guide covers the symptoms and what to do after an attack.
6. Plan a PrestaShop upgrade if your store runs on PHP 8.1 or older.

For administrators of Ubuntu or Debian servers: update PHP and check that the package includes the fix (a result above zero means it does):

sudo apt update
sudo apt install --only-upgrade 'php*'
sudo systemctl restart php8.1-fpm
zcat /usr/share/doc/php8.1-common/changelog.Debian.gz | grep -c CVE-2026-109618

A temporary workaround in php.ini or the PHP-FPM pool:

session.upload_progress.enabled = 0
post_max_size = 32M

Tip: the PHP team also suggests setting memory_limit=-1. That trades the risk of a break-in for the risk that a single request eats all of the server’s memory and takes the store down. Without a separate memory cap for PHP processes, it’s better left alone, and it is a job for an administrator, not for a store owner.

Newer related vulnerabilities

The story didn’t end on 21 October. Here is what came next:

• CVE-2026-115560 (23 Oct): another flaw in the same upload progress feature. It only works when an application changes how PHP stores sessions (session.serialize_handler) while running. We found no such change in PrestaShop 9’s code, so the risk for a typical store is low. The fix will come in PHP’s next regular release, and until then the same session.upload_progress.enabled = 0 setting protects you.
• Real-world attacks: on 26 October, CISA added CVE-2026-109618 and CVE-2026-109619 to its catalogue of vulnerabilities exploited in real attacks. Dozens of public exploit samples are available, including variants designed to slip past WAF filters.
• CVE-2026-111497 (26 Oct): a bug in the Brotli library in the Windows builds of PHP. It doesn’t affect stores on typical Linux servers.

Cloudflare or another WAF can filter out some automated attacks, but it can’t replace the patch, especially if your server can be reached directly, bypassing Cloudflare. We explain how to set that up properly in How to secure a PrestaShop server.

A server you don’t have to worry about

PHP2Shell shows that store security is about more than modules and passwords. Someone has to hear about a new flaw on the day it appears, check whether it affects the server, install the patch, restart the services and make sure the store still works. If you’d rather not do that yourself, you can hand it over.

With our PrestaShop server and administration service you get your own VPS set up for PrestaShop and an administrator who takes care of regular updates, security updates included. The server comes with a firewall, key-only SSH login, fail2ban, Cloudflare with DDoS protection and WAF, monitoring and 7 days of backups. We respond to incidents within 4 hours on business days, and the migration of your store is included. The service costs 119 € net per month.

If you suspect your store may have been attacked before the patch reached the server, order a store security audit. We check the core, modules, configuration and signs of intrusion, and the report lists every issue with a risk rating.

Sources

• PHP: October 2026 announcements: fixed versions, workarounds, CVE-2026-115560.
• GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp: technical details of both vulnerabilities.
• PrestaShop Help Center: PrestaShop’s guidance for merchants.
• CISA Known Exploited Vulnerabilities: both flaws listed on 26 October 2026.
• PrestaShop system requirements for 1.7, 8 and 9: supported PHP versions.

Frequently asked questions

Have a question about PHP on your store’s server? Get in touch or have a look at our PrestaShop server and administration service.

Products in this article

PrestaShop server and administration (1 month)

€119.00

Rated out of 5 stars based on () review(s)

Add to cart

PrestaShop upgrade

€1,999.00

Rated out of 5 stars based on () review(s)

Add to cart

Store security audit

€239.00

Rated out of 5 stars based on () review(s)

Add to cart

Back to Blog