PHP2Shell Impact on Magento and WordPress: Risks and Fixes

If your Magento or WordPress site runs on PHP, PHP2Shell is a server-level problem, not a plugin problem. It is a pair of critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on your web server without logging in. Updating Magento, WordPress, or any extension will not fix it. Only a patched PHP version will.

Quick answer: PHP2Shell affects PHP 5.4 through 8.5. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A successful attack can give an attacker control of the server, which on Magento means access to customer and order data and a way to inject payment skimmers, and on WordPress means backdoors, spam injection and stolen credentials.

If you run a store or a site for a living, this post walks through what actually happens, what each platform stands to lose, how to check if you were hit, and what to do this week. Details are current as of 26 October 2026, and the situation is still moving.

What is PHP2Shell?

PHP2Shell is the name Wiz gave to two memory-safety bugs in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619, that allow remote code execution. Both are rated critical at 9.2 on CVSS v4.0 by the PHP team, and watchTowr scored the issue 10.0. They affect PHP from 5.4 (released in 2012) up to 8.5.

In plain terms, the two bugs work like this:

• CVE-2026-109618 is about running out of memory. PHP can end up using half-initialised data during cleanup, which an attacker may turn into code execution. Researchers demonstrated this on Apache mod_php with default limits.
• CVE-2026-109619 is about leftovers after a fatal error. A later request handled by the same PHP worker can touch memory that was already freed. It has been shown on mod_php and, under the right application conditions, on PHP-FPM through the session upload-progress feature.

The name sounds like a malware family, but it is a vulnerability. The “shell” in the name is what the attacker is after: a command shell on your server. Once they have one, they can drop a web shell file and come back whenever they like.

The fixes shipped on 21 October 2026. PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12, plus source-only patches for end-of-life 7.4, 8.0 and 8.1.

Why Magento and WordPress are in the blast radius

Both platforms are PHP applications, and PHP runs almost 70% of websites, so Cloudflare names WordPress and Magento specifically as widely used platforms that could be affected. Sansec, which tracks Magento security, lists Magento, WooCommerce and Shopware stores among the exposed systems.

The important point is where the bug lives. Because it sits in the PHP runtime, nothing inside your application can close it. A fully updated Magento 2.4.x or WordPress core, a clean theme and zero outdated plugins still run on whatever PHP binary your server uses. If that binary is vulnerable, so are you.

There is also an age problem. About 59% of the 1.5 million internet-facing hosts that report a PHP version run a branch with no official release, and WordPress.org statistics put 35.1% of WordPress sites on an unsupported PHP version. Those sites need a PHP upgrade or a vendor backport, not just a patch.

Impact on Magento and Adobe Commerce stores

A Magento server that falls to PHP2Shell hands the attacker everything the PHP process can read, and on a typical store that is a lot. Researchers have also shown unauthenticated disclosure of worker memory, which can leak passwords, tokens and API keys.

The realistic consequences for a store owner are these:

• Config and credential theft. app/etc/env.php holds database credentials, the crypt key and session settings. Payment gateway keys, SMTP logins and ERP or marketplace API tokens often sit in the database or config too.
• Customer and order data exposure. With database access, names, addresses, emails and order history are in reach, which triggers GDPR and similar breach-notification duties.
• Payment skimmers. Magento stores are a long-standing target for JavaScript card skimmers injected into checkout. Code execution on the server makes planting one easy and keeps it hidden from the admin panel.
• Backdoor admin users and web shells. Attackers typically add a persistent PHP file in pub/, media/ or a cache folder, and sometimes a new admin account, so patching PHP later does not remove them.
• PCI DSS fallout. An unpatched critical flaw on a server in the cardholder-data environment is hard to defend in an audit, and a confirmed compromise can lead to a forensic investigation and acquirer penalties.
• Downtime and trust. Some organisations took sites offline to patch, and the NSA advised doing the same if you cannot update immediately. For a store, every hour offline is lost orders.

Magento-specific hosting matters too. Many stores run on managed platforms such as Hypernode, Adobe Commerce Cloud or a host’s own stack, where the host controls the PHP version. Ask your host for written confirmation of the patched version rather than assuming. If you manage your own stack, remember that Magento supports only specific PHP versions per release, so check Adobe’s system requirements before jumping branches. Test on staging first, with your extensions and a Hyvä or Luma theme build.

Impact on WordPress sites

For WordPress, PHP2Shell turns every site on a vulnerable server into a potential foothold, and on shared hosting that can mean neighbouring sites too. The WordPress angle is mostly about scale: WordPress runs a huge share of the web, and a large slice of it sits on old PHP.

Here is what an attacker can do once they have code execution:

• Steal wp-config.php. It contains database credentials and the authentication salts and keys. With the database, they can create administrator users or read user data.
• Plant backdoors that survive updates. Web shells hidden in wp-content/uploads, inside a theme, or disguised as a plugin file are common, as are rogue must-use plugins.
• Inject SEO spam and malicious redirects. Pharma and casino pages, cloaked links and redirects shown only to search engine bots or mobile visitors.
• Pivot across a shared account. If several sites share one hosting user, a single compromise can infect all of them.
• WooCommerce exposure. Shops get the same customer-data and skimmer risks described for Magento above.

Do not confuse this with the separate wp2shell WordPress exploit disclosed earlier in 2026. That one targets WordPress code, while PHP2Shell targets the PHP runtime underneath it. A site can be exposed to either, or both.

One practical difference from Magento: many WordPress sites sit on cheap shared or managed hosting where you cannot change the PHP binary yourself. Your job is to confirm the host has patched and to move to a supported PHP version in the hosting control panel.

What it means for SEO, revenue and compliance

A compromised site loses organic traffic faster than most owners expect. Search engines flag hacked content, browsers can show red warning pages, and injected spam pages can bury your real ones in the index. Recovery takes weeks even after the cleanup, because Google has to re-crawl and re-evaluate the site.

The damage shows up in a few places:

• Rankings and indexing. Spam URLs, cloaked content and redirects dilute your site and can trigger manual actions.
• Blacklisting. Safe Browsing and email providers can block your domain, which hits paid campaigns and transactional email as well.
• Conversion and trust. Shoppers who see a security warning rarely come back to check out.
• Legal and compliance. Stolen customer data can bring breach-notification duties under GDPR, and card data adds PCI DSS consequences.
• Cost of delay. Exploitation was reported in the wild within days of disclosure, and Sansec warned of mass exploitation within 15 minutes of the release. Amazon Threat Intelligence even identified an attempt dating to 17 October, four days before the patch.

That last point matters: if your server was unpatched before 21 October, patching now does not prove you were clean.

How to check whether you are exposed or already hit

Start with exposure. Check the PHP version your web server actually uses, not just the command-line one, which can differ. In WordPress, Tools > Site Health > Info > Server shows it. In Magento, use a small phpinfo check on staging or ask your host. You are covered only if you run 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer, or a distribution backport that your vendor confirms in its advisory.

Then look for signs of compromise, going back to at least June 2026 as CybelAngel advises. Typical indicators:

• New or recently modified .php files in upload, media, cache, var/ or pub/ folders.
• Unknown administrator accounts in Magento admin or WordPress Users.
• Changed index.php, .htaccess, theme functions.php or Magento layout and CMS blocks containing unfamiliar script tags.
• Unexpected outbound connections or child processes spawned by the web server user.
• Odd spikes in server load, new cron jobs, or strange entries in access logs, especially large multipart POST requests.
• Search results showing pages you never published.

Tools that help: a malware scanner such as Sansec eComscan for Magento, Wordfence or Sucuri for WordPress, file integrity comparison against clean core files (wp core verify-checksums), and a git diff of your codebase against the last known good commit. Avoid running public proof-of-concept code on a live site to “test” it. Qualys explicitly advises against it, and some circulating fake PoCs are not what they claim.

Cleanup and recovery: what to do in order

Patching first and cleaning second is the wrong order if you suspect a compromise, but patching is still step one, because otherwise the attacker simply returns. Work through this sequence:

1. Patch PHP and restart workers. Running PHP-FPM or Apache processes keep vulnerable code in memory, so restart them after the update and verify the version served to web requests.
2. Take a full backup and snapshot of files and database for forensics before changing anything.
3. Put the site in maintenance mode or restrict it by IP or VPN while you investigate.
4. Remove malicious files. Replace core and vendor code from clean sources rather than editing infected files. For Magento, reinstall with Composer and redeploy. For WordPress, reinstall core, plugins and themes from fresh downloads.
5. Rotate every secret. Database password, Magento crypt key and admin passwords, WordPress salts and admin passwords, payment gateway and API keys, SSH and SFTP credentials.
6. Audit users and scheduled tasks. Delete rogue admins, cron jobs and must-use plugins.
7. Check the database and checkout. Look for injected scripts in CMS blocks, footer scripts and payment configuration, which is where Magento skimmers like to hide.
8. Re-scan and monitor. Run a second scan after cleanup and watch logs for several weeks.
9. Notify where required. If customer or card data may have been exposed, involve your legal contact, your payment provider and, where applicable, the data protection authority.
10. Request a review in Google Search Console if you received a security warning.

If you do not have in-house expertise, a professional incident response team is cheaper than a second infection.

Prevention and hardening checklist

The only complete fix is a patched PHP. Everything else on this list reduces risk or buys time, and maintainers have said the temporary mitigations are incomplete.

Do now (both platforms)

• Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer), then restart PHP-FPM or Apache.
• If you are on PHP 8.1 or older, move to a supported branch or get a vendor backport, such as from cPanel, CloudLinux or your Linux distribution.
• Ask your host for written confirmation that the patch is applied.
• Turn on Cloudflare’s managed WAF rules in block mode as an extra layer, knowing it does not replace patching.

If you cannot patch today

These steps are partial, per Qualys and JFrog.

• Set session.upload_progress.enabled=0 in php.ini or the FPM pool config, not via ini_set() or .user.ini, and restart workers.
• Cap request sizes with post_max_size and upload_max_filesize, and limit multipart uploads at the proxy.
• On PHP 8.5, set fatal_error_backtraces=0.
• Consider pm.max_requests=1 on PHP-FPM if performance allows.
• Restrict public access by IP allowlist or VPN, or take the site offline.

Note the trade-off: Qualys also describes enforcing memory_limit=-1 for one of the bugs, which removes a safeguard against resource exhaustion. Treat it as a stopgap and restore a finite limit after patching.

Longer-term hygiene

• Keep an inventory of every PHP install, including containers, staging servers and bundled copies.
• Disable PHP execution in upload and media directories.
• Use file integrity monitoring and alerts for new PHP files.
• Enforce two-factor authentication on Magento admin and WordPress admin.
• Keep Magento, WordPress, themes and extensions updated as well. They do not fix PHP2Shell, but they close other doors.
• Test PHP upgrades on staging, including Hyvä or theme builds, FishPig or other integrations, and checkout flows.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution on web servers running PHP 5.4 through 8.5.

Does PHP2Shell affect Magento?

Yes, if the server running Magento or Adobe Commerce uses a vulnerable PHP version. The flaw is in PHP, not in Magento, so updating Magento alone does not fix it. You need a patched PHP release.

Does PHP2Shell affect WordPress?

Yes, in the same way. WordPress and WooCommerce run on PHP, so any site on an unpatched PHP runtime is exposed regardless of how up to date its plugins and themes are.

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 7.4, 8.0 and 8.1 are end-of-life and received source patches only, so use a vendor backport or upgrade.

Will a firewall or Cloudflare protect me?

A WAF helps as an extra layer, and Cloudflare deployed managed rules on 21 October. It is not a substitute for patching, and attackers have been seen changing payloads to evade rules.

How do I know if my site was hacked?

Look for unknown PHP files, new admin users, modified core or theme files, unexpected outbound connections and spam pages in search results, going back to at least June 2026. Scan with a malware tool and compare files against clean copies.

Is a plugin or theme update enough?

No. Plugin, theme and platform updates do not change the PHP runtime. Only a PHP update, applied by you or your host, closes the hole.

Conclusion

PHP2Shell is a reminder that the stack under your store or blog matters as much as the code you maintain. Patch PHP, restart the workers, confirm the served version, then check for signs of compromise from before the patch. If you run Magento or WordPress for clients, send them a short note today asking what PHP version they use and who owns the upgrade.