On October 21, 2026, patches were released for two critical vulnerabilities in PHP, the technology on which every PrestaShop store runs. The vulnerabilities were named PHP2Shell. Under certain conditions, they allow an attacker to compromise the server without logging into the store.
PHP2Shell is the collective name for two vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Under specific conditions, they allow an external attacker to execute their own code on the server with application privileges.
The good news is that patches are already available, including for some older versions of PHP. Below, we explain what this means for your store and what you should check.


































