PHP2Shell: what online store owners should do now

What to do today#

1. 1

   Find out which PHP version your store runs

   Check your hosting control panel or, on WordPress, Tools, then Site Health, then Info, then Server. Write down the version and whether your host manages PHP for you.

2. 2

   Update PHP or ask your host to confirm the patch

   Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host in writing whether your server has the October 21, 2026 fixes for CVE-2026-109618 and CVE-2026-109619.

3. 3

   Back up the store before and after

   Download a full backup of the files and the database, and keep a copy off the server, so you can restore a clean version if something is wrong.

4. 4

   Update the shop software and every plugin

   Install pending updates for WordPress, WooCommerce or your store platform, the theme and every plugin or module, and remove the ones you no longer use.

5. 5

   Check admin users and change passwords

   Remove administrator accounts you do not recognize, then change the admin, hosting, database and email service passwords and API keys stored in the shop.

What happened, in plain language#

PHP is the programming language that many self-hosted online stores run on. On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 ^S1. Security researchers call the pair PHP2Shell ^S5S6. Both are rated 9.2 out of 10 ^S5.

The flaws sit in PHP itself, not in a particular plugin. According to the PHP project, they affect all PHP installations that serve web requests, and on some server setups a request from someone who is not logged in can trigger the attack before any store code runs ^S1. That means your admin login, a security plugin or a strong password cannot block it on their own. The PHP project states that there are no complete workarounds and that updating is the only safe choice ^S1.

Attack attempts started early. Datadog reports that AWS saw exploitation attempts as early as October 17, 2026, before the fix was public ^S6. On October 26, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog, which lists flaws with evidence of active exploitation ^S3S4.

A separate issue, CVE-2026-115560, was disclosed by the PHP project on October 23, 2026. It is not part of PHP2Shell and is not fixed by the October 21 releases. It only affects applications that combine unusual session settings, the fix is planned for the next regular release, and the recommended setting until then is session.upload_progress.enabled = 0 ^S2. This article reflects the situation as of October 30, 2026.

Am I affected?#

If you host your own store, it very likely runs on PHP. WordPress is a PHP application ^S7, so WooCommerce stores run on PHP, and so do Magento (Adobe Commerce), PrestaShop and OpenCart. A blog, landing page or customer portal on WordPress counts too, even if the shop itself is elsewhere.

To see your PHP version, look in your hosting control panel, where it usually appears under a PHP settings or PHP version menu. In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later in each branch ^S1.

The version number does not always tell the whole story. Linux distributions and hosting vendors received the patches in advance and may backport fixes into their own packages without changing the version number ^S1S6. If you are unsure, ask your host directly whether the server includes the fixes for CVE-2026-109618 and CVE-2026-109619.

Stores on PHP 8.1 or older are in a harder spot. The PHP project no longer updates those versions; some vendors provide backported fixes, and the PHP project points users to them or to an upgrade ^S1. Also note that PHP 8.2 reaches end of life on December 31, 2026 ^S1.

What to do today#

The numbered checklist above is the short version. A few details make each step safer.

If you manage the server yourself

Update PHP through your system packages or your control panel, then restart PHP and the web server so every worker uses the fixed version. CISA recommends patching internet-facing systems right away and, if a system cannot be patched quickly, taking it offline or putting a web application firewall in front of it as a temporary measure ^S3. The PHP project lists some interim settings, but warns that they do not make an installation safe ^S1.

If a host or agency manages it

Send a short written request: “Please confirm that our server has the PHP fixes for CVE-2026-109618 and CVE-2026-109619 released on October 21, 2026, and tell us the PHP version or package we are on.” Keep the reply with your records.

Back up before you change anything

Take a full backup of the files and the database and store it somewhere other than the server. If the store was compromised before you patched, an older clean backup may be what you restore from, so do not overwrite older backups yet.

Update plugins and check admin users

Patching PHP closes this hole, but the rest of the store still needs care. Update WordPress, WooCommerce or your platform, the theme and every plugin. In the user list, look for administrator accounts you did not create. Then change passwords and regenerate the API keys and SMTP passwords stored in the shop, such as those for your payment, shipping and email services, because anyone who had access to the server could have read them.

Protecting your customer list and email reputation#

A store database holds more than orders. It usually contains every customer’s name, email address, shipping address and purchase history, plus the subscriber list for your newsletter. An attacker who can run code on the server can often read that database, and can also use the server to send email in your name.

Signs that something is wrong

• Bounce messages or replies to emails you never sent.
• A warning from your host about outgoing spam or unusual server load.
• Administrator accounts, plugins or files you did not add, or changes to the checkout page.
• DMARC reports that show servers you do not use sending as your domain.
• A sudden rise in spam complaints, or your domain or server IP address appearing on a blocklist.

Your domain’s sender reputation takes time to build and can drop quickly when spam goes out under your name. SPF, DKIM and DMARC records tell inboxes which servers may send for your domain, and DMARC reports show you who is trying; the SPF, DKIM and DMARC explainer covers each record, and the DMARC setup guide shows how to read reports. If your shop server is not supposed to send marketing email at all, leaving it out of your SPF record limits what a compromised server can do with your domain.

If customer data may have been exposed

Legal duties after a breach differ by country. Many data protection laws require you to notify a regulator, the affected customers, or both, within a set time, so check the rules in each market where you sell, or ask a lawyer, before you write to customers. Our guide to email marketing laws covers consent rules by market; breach notification rules are separate and depend on your local law.

When you do contact customers, keep it plain: what happened, which data was involved, what you have done, and what they should watch for. Phishing emails that pretend to come from the shop are a common follow-up, so tell customers that you will never ask for their password or card number by email. For a brand like Ninefold, that message would go from the usual sender address, with no discount offer attached, so it does not look like marketing.

Reducing what can go wrong next time#

PHP2Shell will not be the last urgent update. A store that is simpler to keep current is easier to protect.

• Fewer plugins. Every plugin or module is code that runs on your server and needs updates. Remove the ones you no longer use, and replace several small ones with one well-maintained one where you can.
• A supported PHP branch. Plan the move off PHP 8.2 before its end of life on December 31, 2026, and off anything older now ^S1.
• Managed hosting or services. Managed hosting, or hosted services for tasks such as payments, search or email, moves patching to a provider whose job it is. Ask how quickly they patched this time.
• Automatic updates and off-server backups. Turn on automatic minor updates where your platform supports them, and keep regular backups somewhere other than the server.
• A named owner. Decide who watches security notices for the store, whether that is you, a developer or the host.

Where Tellnod fits#

Tellnod is an MCP connector for writing, previewing and sending marketing email from Claude or ChatGPT. It runs as a hosted service on Tellnod’s own infrastructure, not on your shop’s server, so using it instead of an email marketing plugin means one less plugin to update on the server and one less sending credential stored in your store database.

That reduces what sits on your server; it does not make your store secure. You still need to patch PHP and your shop software, and your customer list then also lives with Tellnod, so it is fair to ask how any provider protects it. The security page explains how Tellnod handles sending and data. To try it, connect Tellnod to Claude or ChatGPT; nothing goes out until you press Confirm on the approval card.

FAQ#