Information as of October 22, 2026

On October 21, 2026, patches were released for two critical vulnerabilities in PHP, the technology on which every PrestaShop store runs. The vulnerabilities were named PHP2Shell. Under certain conditions, they allow an attacker to compromise the server without logging into the store.

The good news: patches are already available, including for some older versions of PHP. Below, we explain what this means for your store and what you should check.

In short:

• The vulnerabilities affect PHP, not PrestaShop itself. Having the latest version of the store does not guarantee a secure server.
• The fix is implemented by your shared hosting provider, server administrator, or developer/DevOps specialist.
• Do you have PHP 7.4, 8.0, or 8.1? You don’t need to upgrade right away—check if a backport update is available.
• After updating PHP, make sure the store is actually using the patched version of PHP and test the store.

You’ll find details on this process below.

What is PHP2Shell and why does it affect your store?

PHP2Shell is the collective name for two vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they allow an external attacker to execute their own code on the server with application privileges.

What can an attacker do?

It depends on the server’s configuration. In the worst-case scenario, they could gain access to:

• the store’s files,
• settings,
• database access credentials.

This does not mean that every store has been or will be attacked. A vulnerable environment still requires an urgent update.

If your store is currently operating normally, that doesn’t mean anything yet

The vulnerability shows no visible symptoms. The store is running, orders are coming in, and there are no errors. The only way to be sure is to check whether the version of PHP used by the store has been patched.

The current version of PrestaShop does not protect against PHP2Shell

You may have the latest version of the store and all modules up to date, yet still be using a version of PHP that is vulnerable to attack.

You cannot fix this vulnerability by updating the store. The patch must be applied on the hosting or server side.

Who is responsible for updating PHP?

Server type	Who typically implements the fix
Shared hosting	Hosting provider
VPS or dedicated server	Administrator—check whether this is covered by your administration service

Tip: Ask specifically about PHP2Shell patches. The statement that “the store is up to date” says nothing about the status of PHP.

Which current PHP versions have the patch?

Patches are available for all currently supported PHP branches, and thanks to Plesk, also for older PHP versions.

NOTE! Support is available for PHP versions 8.2–8.5.

PHP 8.2–8.5: patched versions

PHP Branch	Version with patches
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

Before you decide to upgrade to a newer version of PHP, check which updates are available in your server’s control panel. Ask your provider to confirm that they address both vulnerabilities.

Information on PHP Versions and Support

The image below shows, in order:

1. Successive PrestaShop versions from 1.7 to 9.1 and the PHP versions supported by those PrestaShop versions.
2. PHP versions and their official support—if a PHP version is no longer supported (e.g., 7.2), it no longer receives official security patches

Conclusion: It’s a good idea to update PrestaShop regularly and upgrade the PHP version on your server.

What to do? A 5-step plan

If you use shared hosting (FTP)—you’re partly dependent on your hosting provider. Check your server settings, and if you don’t find a secure PHP version there, contact your server administrator.

If you have a VPS, a dedicated server, or use cloud solutions—you should handle updates yourself.

1. Check for available PHP updates in your server control panel or with your hosting provider. Look for clear labels indicating the vulnerability in question
2. Ask your developer or server administrator about PHP2Shell patches and request confirmation that they address both vulnerabilities.
3. Do you have an older version of PHP? Before upgrading PHP in your server settings (which can be risky for the stability of an older store), check if a backport is available for your PHP version.
4. Consider testing PHP on the store’s development environment.
5. After the update, verify that the store is using the patched PHP —details below.
6. Test sales functionality: shopping cart, order, payment, and integrations.

What to check after the update?

1. Is the store actually using the new PHP version?

Multiple versions of PHP can run on a single server. The store’s domain, cron jobs, and hosting control panel may use different versions of PHP.

Therefore, check whether:

• the store’s domain is running on the updated version of PHP,
• the required service restarts have been performed.

Note: The `php -v `command in the terminal may display information about a different PHP installation than the one powering the website.

2. Does the checkout process in the store work without issues?

After making changes, follow the customer’s path:

• adding a product to the cart,
• placing a test order,
• initiating payment,
• check that key integrations (e.g., couriers, ERP, price comparison sites) are working.

Is your server not providing updates?

The absence of new packages doesn’t necessarily mean there are no updates. The cause is often a problem with the repository or the package signing key. In that case, the system uses old lists and doesn’t see new releases. Warnings, signature errors, or unclear messages must be clarified before you consider the server up to date.

If your hosting provider doesn’t offer support in this area, consult a specialist (such as us).

Cloudflare partially resolves the issue

Cloudflare rules will help, but they are no substitute for updates

Cloudflare has released protective rules for PHP2Shell, even on the free plan. This is an additional layer of security. However, it does not replace PHP updates.

Not sure how to check this? We’ll do it for you

Not sure which version of PHP your store is running? Not sure if the patch has already been installed? Have you tried installing the patch yourself or with your team, but the update ends in an error? Take advantage of our PrestaShop administration and technical support.

• If you’re using a VPS, dedicated server, or cloud solution, we’ll apply the necessary PHP updates.
• If you’re using shared hosting (FTP), we’ll check your control panel or contact your server administrator.

Once you send us a message via the contact form above, you’ll receive a secure PHP script that you can use to check PHP on your server yourself. The script will verify your PHP version and provide clear information on whether PHP is secure in your store:

You’ll also receive an offer from us for rapid PHP security hardening by our DevOps team. As part of the PHP update:

• we’ll check your store’s environment,
• we’ll select the appropriate updates,
• we’ll verify that your store is functioning properly after implementation,
• if there are no patches available for your version, we’ll determine an alternative security solution.

Please contact us, providing your store’s URL and hosting provider. If you know your PrestaShop and PHP versions, please include them—this will help us determine the scope of work more quickly.

Contact Form

If you’re already a client, open a ticket on the HelpDesk

+48 506 312 999