On 21 October 2026 the PHP project released fixes for two critical vulnerabilities in PHP itself. Both are rated CVSS 9.2, and the researchers who found them call them php2shell. The problem is not in PrestaShop or in any module, but because every PrestaShop store runs on PHP, it affects virtually every store. Below: what is going on, which PHP versions are fixed and what you should do today.
What is the problem?
The two vulnerabilities are in the PHP runtime, the layer that runs before PrestaShop's own code. According to the announcement, an attacker can use them to crash PHP processes, to read sensitive data or, in the worst case, to run code on your server without logging in.
- CVE-2026-109618: when PHP runs out of memory, request data can be left half-initialised, and the cleanup afterwards treats that incomplete data as valid.
- CVE-2026-109619: internal request state can survive after its memory has been freed, so a later request on the same PHP worker can use that stale state.
Every PHP installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php.
Why a PrestaShop update does not help
Updating PrestaShop or your modules does not fix this. Protection inside the application cannot stop an attack that takes place before the application code runs. The only real fix is an updated PHP version on your server.
Which PHP versions are fixed?
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
For PHP 7.4, 8.0 and 8.1 the PHP project has published minimal backports. Note that Linux distributions sometimes apply the fix without changing the version number, so a version that looks older can still be patched. That is why you should ask your host for confirmation rather than going by the number alone.
What you should do now
1. Check your PHP version
In the PrestaShop back-office, go to Advanced Parameters > Information. There you see which PHP version your store runs on.
2. Ask your host for written confirmation
Contact your hosting provider and ask whether the fix for CVE-2026-109618 and CVE-2026-109619 has been applied to your server. Ask for the answer in writing.
3. Do you manage your own server?
- Install the updated PHP packages from your distribution or the official PHP releases.
- Restart every PHP process: PHP-FPM pools, Apache, LiteSpeed and FrankenPHP workers. An update that is installed but not loaded does not protect you.
- On the day of the release, the PHP project advised against waiting for the volunteer-run
rpms.remirepo.netrepository and recommended distribution packages or building from source. - Using Docker? Rebuild your images on the updated base image and deploy them again.
4. Still on PHP 8.1 or older?
Ask your host whether your PHP version has been patched. Upgrading PrestaShop to a version that supports newer PHP is a separate, longer-term job, not an emergency fix. For planning: PrestaShop 9 supports PHP 8.1 up to 8.5, and PHP 8.2 reaches end of life on 31 December 2026. PrestaShop 1.7 and 8.x stores usually still run on PHP 7.x or 8.1.
Temporary measures if you cannot update yet
These measures are meant for technical teams. Test them on a staging copy first; they reduce the risk but do not replace the PHP update.
For CVE-2026-109618:
- Lower
post_max_size: the advisory suggests8Mif your store accepts no uploads and32Mif it does. Keepupload_max_filesizebelow that value. - Also enforce request size limits in your web server or reverse proxy.
For CVE-2026-109619:
- Set
session.upload_progress.enabled=0inphp.ini, the PHP-FPM pool or the server configuration, and restart all workers.ini_set()or.user.iniis not enough. - On PHP 8.5, also set
fatal_error_backtraces=0and restart the workers.
Hiding errors with error_reporting, display_errors or @ does not help. The full list of measures is in the official PHP security advisory.
Does a web application firewall help?
Cloudflare has rolled out dedicated WAF rules for php2shell, active by default since 21 October. On a paid plan, check that the managed ruleset is set to block. Keep in mind that a WAF only protects traffic that goes through it: make sure your server only accepts web traffic from your WAF provider. A WAF is an extra layer, not a replacement for the PHP update.
Need help?
Not sure whether your server has been patched, or are you still on an old PHP version? We check your PHP version and configuration, ask the right questions to your host and help you plan the step to a supported PHP and PrestaShop version. Read more about our security service, plan an upgrade or ask us a question.
Source: "Critical PHP security updates: what PrestaShop users need to know" on build.prestashop-project.org (21 October 2026), and the PHP security advisories for CVE-2026-109618 and CVE-2026-109619.
