PHP2Shell and Adobe Commerce: What Every Store Needs to Patch, Check and Protect

On 21 October 2026, PHP shipped emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. This guide answers three questions: Is our store exposed, who fixes it, and what should we check once the patch is on?

What PHP2Shell Is and What's at Stake

PHP2Shell involves two flaws in the PHP runtime itself, both rated critical with a CVSS score of 9.2 out of 10. When PHP aborts a request mid-task, it can leave memory in a broken state that a later request can abuse: a use-after-free condition (a memory bug where software keeps using memory after releasing it, letting an attacker place their own data there). The result is remote code execution (an attacker runs their own commands on your server from the internet) without a login.

PHP processes each request before Adobe Commerce code runs, so clean code and audited extensions often make no difference. Any web-facing PHP setup is at risk, and Apache mod_php carries the highest risk.

What an Attacker Can Do With It

• Run commands on your server without logging in
• Read passwords and API keys leaked from server memory
• Plant payment skimmers or hidden admin accounts
• Inject spam pages on your domain and drag down your search rankings.
• Create PCI DSS and GDPR exposure if card or customer data is reached

"There are no complete mitigations; updating is the only safe choice." PHP Security Team, PHP2Shell advisory.

Which Adobe Commerce Stores Are Exposed

Adobe Commerce stores on an unpatched PHP build are exposed to PHP2Shell, and your deployment model decides who has to fix it.

Adobe Commerce as a Cloud Service (SaaS)

Adobe operates the runtime. Confirm with your account team, and check any PHP middleware you host yourself.

Adobe Commerce on Cloud Infrastructure (PaaS)

Adobe manages the cloud infrastructure, and your team pins the PHP version in the application configuration. We found no Adobe guidance specific to these CVEs as of October 23, 2026, so open a support ticket and ask:

• Has the patched build reached integration, staging and production?
• Does each environment need a redeploy?
• Does the Fastly WAF cover PHP2Shell on every environment?

On-Premises, Self-Hosted or Third-Party Hosting

You or your hosting provider owns PHP. Update the PHP packages, then restart PHP-FPM or Apache so every worker loads the fixed version. Ask your host for written confirmation of the version now serving your store.

Your setup decides who patches. Assign one owner to confirm the fixed PHP version on every environment, staging included.

The PHP 8.1 Gap in Older Adobe Commerce Versions

PHP released fixes only for 8.2 and newer. PHP 8.1 and older get no official release, so stores on those versions depend on vendor or community backports that someone has to apply and test.

Per Adobe's system requirements:

On Adobe Commerce 2.4.4 to 2.4.6, plan two moves. First, secure the store on your current PHP version. Apply a vendor or community backport of the fix and the interim hardening settings, and test them before they reach production. Then upgrade Adobe Commerce onto a supported PHP version.

According to Adobe’s lifecycle policy, PHP 8.1 reached end of life on December 31, 2025, and Adobe warns that PCI compliance is at risk for stores still running it.

How to Patch Adobe Commerce Against PHP2Shell

Step 1: Confirm the PHP version actually serving the store

Check from a web request. The command-line binary can differ from the one serving pages, so verify through the web server or hosting dashboard.

Step 2: Update to a fixed PHP release

Patched versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Restart PHP-FPM or Apache, because running workers keep old code in memory.

Step 3: Use interim mitigations only as a bridge

Settings PHP suggests while you patch:

• session.upload_progress.enabled = 0, then restart workers
• A low post_max_size (8M, or 32M with uploads)
• WAF virtual-patch rules in blocking mode

What not to rely on:

Maintenance mode and error suppression do nothing here, because PHP handles the request first. A WAF helps but is not a fix. According to Cloudflare, attackers were mutating their payloads to get past its rules.

Step 4: Regression-test revenue journeys

Test checkout, payments, search, integrations and admin uploads on the patched build.

Check for Signs of Compromise After Patching

Amazon's honeypots recorded an exploitation attempt on 17 October, four days before the fix existed.

As of October 23, 2026, we found no public report of a confirmed breach. A missing confirmation does not prove your store is clean, and the patch does not remove anything that got in before it.

Review activity from 17 October for:

• New or changed admin users
• Unknown PHP files in pub/, media or upload directories
• Unexpected cron jobs or scheduled tasks
• PHP processes launching shells, curl or wget
• Unusual outbound connections from PHP workers

Rotate Credentials That May Have Leaked

Rotate API tokens, integration keys, admin and database passwords, and payment gateway keys used during the exposure window.

Don't Overlook Search Visibility

Check the Security Issues report in Google Search Console and crawl for pages you didn't publish.

If spam pages have already hurt your rankings, our SEO team can help you clear them from search results and win back lost traffic.

Encrypt Customer Data at Rest to Limit the Damage

Patching closes the way in. You also need to know what an attacker could read if they got through. Adobe Commerce hashes customer passwords and encrypts payment credentials, but names, email addresses, phone numbers and street addresses sit in the database as plain text. A leaked backup or a stolen database login exposes all of it.

PII Shield, Codilar’s field-level encryption framework built with Libsodium, helps limit that damage:

• Encrypts customers, carts, orders, invoices, shipments, credit memos and admin users
• Decrypts in real time for authorised users, so checkout, search and admin work as usual

It does not replace patching. A copied database yields encrypted records that stay unreadable without the keys.

How Codilar Helps Secure Your Adobe Commerce Store Against PHP2Shell

Stabilize in 48 Hours

Start with a free PHP2Shell Exposure Check, run read-only and with your written consent, with findings in 48 hours. Where action is needed, our engineers patch PHP or secure the store within its current PHP version through tested backports, hardening and WAF virtual patching.

The target is 48 hours for standard environments, with checkout and integration regression-tested.

Secure What Matters

Compromise sweep, credential rotation, custom hardening and SEO clean-up.

Strengthen for The Next One

Wiz said AI turned a long-standing flaw into a working exploit, so patch windows will keep shrinking.

We move stores onto supported PHP and Adobe Commerce releases and add PII Shield for field-level encryption. After the move, our managed services and DevOps teams keep your environment patched and monitored.

For JPW Industries, we run 24/7 server operations across six brand sites and act on vulnerability alerts the same day.

See what JPW Industries says about working with us.

❝

Every PHP2Shell call we took this week started with 'Are we patched?' The better question is whether you could answer that in an hour, every time.❞

Shahed Jamal | Practice Head - Adobe Commerce