Read the full guide: PHP2Shell Vulnerability Explained: Critical PHP RCE
https://meetanshi.com/blog/magento-2-php-vulnerabilities-security-alert/

BHAVNAGAR, Gujarat, India (October 22, 2026) - Magento and Adobe Commerce merchants running older PHP versions face a harder fix than usual after the PHP project patched two critical remote code execution flaws on October 21. The bugs, known as PHP2Shell, let an attacker run code on a server without logging in. Stores on PHP 8.1 or older received no official update, and Meetanshi, a Magento development company, says many of those stores will need a platform upgrade before they can be secured.

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2. The PHP project issued fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to research from Sansec, the vulnerable code has been in PHP since version 5.4, and unauthenticated code execution was confirmed against Magento 2.4.9. Cloudflare reported attacks several hours before the patched versions shipped.

Why patching Magento alone will not help

The flaws sit in the PHP engine, not in Magento. A store with fully updated Magento code and extensions is still exposed if the server runs an unpatched PHP build. The attack also triggers before Magento loads, which means Magento’s maintenance mode gives no protection. One of the two bugs can leak server memory containing passwords, API keys and session tokens.

The bigger problem is version support. PHP 8.1 and older are no longer maintained by the PHP project. Magento 2.4.5 and earlier releases cannot run on PHP 8.2, so stores on those versions must upgrade Magento before they can move to a patched PHP release. PHP 8.2 also reaches end of life on December 31, 2026.

Recommended steps for store owners
Ask the hosting provider to move the server to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
Confirm the PHP version serving live web requests, not only the command-line version.
If the store runs PHP 8.1 or older, plan a Magento upgrade. Moving to Magento 2.4.7 or later on PHP 8.3 avoids a second upgrade when PHP 8.2 support ends.
Rotate admin passwords, API keys and payment integration credentials after patching.
Treat temporary server-level mitigations as a stopgap only. The PHP project states that updating is the only complete fix.

Meetanshi is assisting merchants with combined PHP and Magento upgrades, including compatibility checks, extension testing and post-upgrade verification. Service details are available at https://meetanshi.com/magento-security-patches-installation-service.html

“Most of the store owners we speak with assumed their Magento patches had them covered. This time the problem is underneath Magento. If your server is still on PHP 8.1, there is no update waiting for you, and the real work is getting Magento onto a version that can run supported PHP. We would rather help someone do that this week than help them clean up a breach next month,” said Sanjay Jethva, CTO and Co-founder at Meetanshi.

Company Information
Meetanshi is an Adobe Commerce, Magento Open Source and Shopify development company founded in 2017, with offices in Bhavnagar, India, and Stuttgart, Germany. The company provides store development, platform migrations, security patching, version upgrades, performance optimization and extension development for merchants across the US, Europe and APAC. More at meetanshi.com.