PHP2Shell: which PHP update does your online store need?

What has been confirmed?

PHP lists 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as patched releases. Distributions and LTS vendors may backport the fixes to their own packages. Ask your provider to identify the installed package build and the vendor advisory that confirms its status.

CVE-2026-109618 concerns invalid internal state after memory exhaustion. CVE-2026-109619 concerns state from an earlier request being used after its backing memory was released. Both official advisories describe possible remote code execution. The conditions and attack paths vary between server environments.

PHP2Shell is the name Wiz uses for its research and combined exploit. Wiz demonstrated attacks against particular WordPress, Drupal and Joomla container deployments. This does not establish that every installation of any named platform has been compromised.

Send your host these five questions

Our practical recommendation is to request written confirmation for each production environment, including checkout, administration and any separate containers. A PHP version reported in a terminal may refer to a different runtime from the one serving your website.

• Which PHP build serves my domain and any separate administration or API environment?
• Does that build contain both CVE fixes, and which vendor advisory or package version proves this?
• Have all relevant workers and containers been restarted after the update, and how was this verified?
• Have the basket, checkout, payment confirmation, administration and background jobs been tested afterwards?
• Which logs and recovery points are available if there are signs of misuse?

A plugin update or WAF does not prove PHP is patched

Your CMS and its PHP runtime are separate components. Record the maintenance status of both. The current PHP advisories identify an update containing the fixes as the only complete solution. Temporary configuration changes reduce specific attack paths without covering every variant.

Disabling upload progress is therefore not a complete fix for both CVEs. Neither is a filter rule, a hidden version header or the presence of a proxy. Have your administrator check temporary controls against the official guidance and assess their effect on your store before applying copied settings.

If patching is delayed, discuss restricting access with your administrator. CERT-EU’s advance warning recommended considering isolation of internet-facing applications when immediate remediation was not possible.

Suspicious activity needs a separate investigation

A successful update does not establish that the environment was clean before patching. If you find suspicious files, unknown administrators or unexpected payment changes, our recommendation is to preserve relevant logs, restrict access and involve your administrator. Do not run an arbitrary exploit against your production store to look for reassurance.

Launching a replacement site does not complete that investigation. Establish which data can be trusted and which credentials or keys need replacing before transferring data into another environment.

When does migration make sense?

Repeated update problems, ageing extensions or unclear maintenance responsibilities can justify reconsidering your store’s architecture. After the urgent fix, assess the functions, management workflow, maintenance and total cost. Changing programming languages does not provide a general security guarantee.

TovieIT can discuss a bespoke rebuild using React and Node.js with hosting. This starts with a function inventory, data agreements, payment and stock tests, URL mapping and a rollback plan. A complete WooCommerce, Magento or Shopware store cannot be treated as a universal one-click conversion.

Use the migration intake to describe your platform, integrations and main problems. Do not include passwords, secret keys or customer files. That gives the first discussion a useful starting point for agreeing the scope.