The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities. Both can let an attacker run code on a web server without logging in. The flaws, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 on the CVSS v4.0 scale.
PHP says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php set-ups the most exposed, because an attack can be triggered there before any application code runs.
Both WooCommerce and Magento run on PHP, so stores on either platform are affected.
WooCommerce has told store owners to update their PHP installations immediately. It confirmed the issue is not specific to WooCommerce or WordPress, and that no update to either is required or planned.
WooCommerce stores hosted on Automattic’s own infrastructure are already protected. That covers WordPress.com, WordPress VIP, Pressable and WP Cloud. WooCommerce is advising merchants on other hosts to check with their provider that PHP has been updated.
WooCommerce merchants can see which PHP version their store runs on under Tools > Site Health > Info > Server in the WordPress dashboard.
STAY AHEAD OF UK ECOMMERCE
Found this useful? This is one of dozens of updates like it we track every week. Get the ones that matter to UK sellers in your inbox, twice a week – free.
WooCommerce also pointed out that PHP versions before 8.2 no longer receive security updates. WooCommerce recommends PHP 8.3 or newer and is raising its minimum PHP requirement in future releases.
For self-managed stores that cannot update straight away, WooCommerce referred merchants to the UK National Cyber Security Centre’s advice. The NCSC says organisations should consider taking the system offline until it can be fully mitigated.
At the time of writing, Adobe had not published guidance on the PHP flaws for Adobe Commerce or Magento Open Source. The vulnerabilities sit below the Magento application, so no Magento patch fixes them.
Ecommerce security firm Sansec reported that researchers at Calif had demonstrated code execution without a login against Magento 2.4.9, as well as WordPress and several other PHP applications. Sansec also noted that the maintenance modes in Magento and WordPress offer no protection. PHP processes the incoming request before the store checks whether it is in maintenance mode.
The PHP release comes eight days after Adobe released a separate critical security update for Adobe Commerce and Magento Open Source on 13th October. Magento merchants need both fixes in place.
PHP 8.1 and older get no official fix from the PHP project. Some Linux distributions and long-term support vendors provide backported patches. PHP 8.2 reaches end of life on 31st December 2026, after which it will receive no further security fixes.
