Full guide: PHP2Shell Vulnerability Explained: Critical PHP RCE
PHP just pushed emergency releases for two bugs, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. The exploit chain has a name now, PHP2Shell, and a public tool to go with it.
If you maintain Magento or Adobe Commerce stores, this one behaves differently from the usual security bulletin. Your Magento code can be fully patched and the server is still exposed, because the bug lives in the runtime underneath it.
Check what's actually serving requests
php -v tells you about the CLI binary. That's often not what PHP-FPM or mod_php is running.
# Magento version
bin/magento --version
# FPM binaries present on the box
ls /usr/sbin/php-fpm*
# Version of a specific FPM build
php-fpm8.3 -v
On managed hosting, just ask the provider which PHP build is handling web traffic for your vhost. Get it in writing.
The patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (PHP advisory). Anything below those in a supported branch needs the update.
The PHP 8.1 problem
PHP 8.1 and older are
Top comments (0)