Why this matters now
A real one from this month: PHP2Shell
PHP sits under a lot of online stores. WooCommerce, WordPress, Magento, and Shopware all run on it. In October 2026, two serious holes showed up in PHP itself.
Patched on 21 Oct 2026CVE-2026-109618 and CVE-2026-109619. Each scored 9.2 on CVSS, which means critical. A CVE is the public ID for a known hole. CISA's alert that day names the fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Wide reachThe bugs go back to PHP 5.4. Your store can be affected even when your own code and plugins are clean.
Not a plugin fixUpdating plugins won't touch this. The PHP version on the server has to change. A lot of the time, only your host can do that.
People reported attack attempts before the fix was public. Researchers have reproduced the bugs in test setups. Sansec says an attack also needs specific conditions on the server. So this isn't a reason to panic. It is a reason to have somebody check your shop.
If the server can't be updated quickly, or it's still on PHP 8.1 or older, CISA says take that PHP system offline until it's patched or upgraded. You and your host make that call. We can help you sort out what to ask them.
This is the week we're built for. We figure out if your store is affected. We test the change on a private copy and check checkout. If your host has to apply the PHP update, we tell you what to ask for. Then you get a short note.
Sources: Sansec Forensics Team, "PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)", 21 Oct 2026. CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", 21 Oct 2026.