PHP2Shell: the PHP code-execution flaw every Magento store needs patched now (CVE-2026-109618, CVE-2026-109619)

Is my Magento store affected?

Yes, if it serves pages through PHP, which every Magento store does. PHP has published fixed releases for the 8.2, 8.3, 8.4 and 8.5 lines and minimal source backports for 7.4, 8.0 and 8.1, which are otherwise out of support. Anything older is unsupported and should be treated as affected. The question is not whether your store is affected but which PHP line it runs, because that decides which fix you need and whether a vendor has to supply it.

Two things follow from that table. A store on Magento 2.4.4, 2.4.5 or 2.4.6 on PHP 8.1 depends entirely on its host or distribution backporting the fix, and the end of life page explains why those lines were already overdue for an upgrade. And a store on 2.4.9 cannot sidestep this by staying on an older PHP: 2.4.9 requires PHP 8.5, so 8.5.12 is the only fixed version it can run.

If you cannot update within the hour

PHP's advisory gives temporary measures and is blunt about them: they "do not make an installation safe" and "only an update is a complete solution". Use them to shorten the exposed window, not to replace the update. Three of them matter specifically to Magento.

Setting `memory_limit` to -1 is the main stopgap for the first bug, and Magento quietly undoes it. PHP's advice is to remove the configurable memory limit so the controllable out-of-memory failure cannot be triggered, and to set it "in a way applications can't override". Magento 2.4.9 ships `memory_limit = 756M` in `.user.ini` and `pub/.user.ini`, a `php_value memory_limit 756M` line in `pub/.htaccess`, and `fastcgi_param PHP_VALUE "memory_limit=756M"` in its sample nginx configuration. Any of those puts a finite limit straight back. The setting only holds if it is applied with `php_admin_value` in the PHP-FPM pool or the Apache configuration, which Magento's files cannot override. Expect memory use to climb, and put a container or cgroup limit around PHP as the safety net; PHP warns specifically against `RLIMIT_AS` and `RLIMIT_DATA`, because they trigger the vulnerable path themselves.

Blocking multipart requests at the web server stops the known trigger and breaks parts of Magento. Multipart is how product images, CSV imports and some storefront forms are sent, so a blanket block disables admin uploads and may affect checkout for some extensions. If you use it, test an order and an admin image upload straight afterwards, and remove it once PHP is updated. Lowering `post_max_size` and `upload_max_filesize` is a gentler version of the same idea; PHP suggests 8M where uploads are not needed and 32M where they are.

`session.upload_progress.enabled = 0` helps with the second bug only. It closes the confirmed session paths and nothing else, and it has to be set in `php.ini`, the FPM pool or the server configuration and followed by a restart of every worker: `ini_set()` and `.user.ini` are too late. PHP also says to remove any deprecated or invalid `php_value` lines applied per request, because diagnostics raised before a request is initialised are one of the confirmed routes for the second bug, and hiding them with `error_reporting`, `display_errors` or `@` does not help.

Maintenance mode is not a mitigation. PHP parses the request before Magento checks the maintenance flag. Taking the store offline at the web server or firewall is, and the NCSC lists it as a last resort where neither the update nor the mitigations can be applied.

Timeline

• 1 to 24 August 2026: Calif finds the first code-execution paths and reports to PHP on 11 August; Wiz Research reports its findings on 24 August.
• 27 August to 18 October: PHP's security team works the fix: the change touches around 390 files and replaces the hard memory-limit exit with a soft limit handled at a safe point.
• 20 October: PHP pre-announces a security release for 14:00 UTC the next day. Details leak on social media the same day.
• 21 October, 03:02 UTC: Cloudflare's WAF rules go live for all plans; Cloudflare later reports attack traffic.
• 21 October, about 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 ship, with backports for 7.4 to 8.1. cPanel's EasyApache 4 25.91, Ubuntu's USN-8948-1 and Debian's fixes land the same day. The NCSC publishes its alert.

What this looks like on managed hosting

On a managed server the PHP update is the host's job, and the right question to ask is a specific one: which PHP version is serving the store right now, and is it one of the fixed ones or a confirmed backport. If the answer is a version number from the table above, you are done. If it is "we are waiting on the control panel vendor", ask which vendor and check that vendor's page yourself, because the dates above show they are not all moving at the same speed.

This is the part of hosting that is invisible until a week like this one. On every EveryHost plan the operating system and the server stack, PHP included, are our responsibility to keep updated, on staging first and then production; the store's own code stays with your developer. The managed Magento VPS plans start from £119 a month + VAT and dedicated Magento servers from £249, both with the nginx and PHP-FPM stack rather than mod_php, which PHP ranks as the highest-risk configuration for this bug. The Magento upgrades and security patching page sets out who does what, and the full price list is on plans and prices. If you would rather talk it through, get in touch.

PHP2Shell arrived eight days after Adobe's own October security bulletin for Magento. If you have not yet applied that, our guide to checking whether your Magento store is patched covers both the Magento side and the server side in one pass, and BlockStrap explains what the October Magento patch fixes.