The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a web server without logging in. Each is rated 9.2 on the CVSS v4.0 scale.
The flaws are in PHP itself, so updating WooCommerce, Magento or any plugin won’t fix them. The update has to be made on the server.
Who’s affected
Any store running on PHP is exposed, including WooCommerce, Magento Open Source, Adobe Commerce, Shopware, PrestaShop and OpenCart. PHP says every installation serving web requests is at risk, regardless of how the server is set up.
Sellers on Shopify, Etsy, Amazon, TikTok Shop and other fully hosted platforms don’t manage the servers their shops run on. If anything needs patching there, it’s down to the platform.
Ecommerce security firm Sansec reported that early attacks were detected on the morning of 21st October, several hours before the fix came out. Sansec also said an exploit tool is now public and it expects mass exploitation to follow.
Check who manages your server
On managed hosting, updating PHP is the host’s job. Automattic has confirmed that WooCommerce stores on WordPress.com, WordPress VIP, Pressable and WP Cloud are already protected.
Merchants with any other managed host should ask their provider whether PHP has been updated to a patched version, and which version their store runs on. WooCommerce says many hosts are also adding firewall rules. These help, but they don’t replace the update.
Merchants who run their own server, such as a VPS or dedicated server, need to make the update themselves.
Check your PHP version
The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any earlier release on the same branch is still vulnerable.
WooCommerce merchants can find their PHP version in the WordPress dashboard under Tools > Site Health > Info > Server. Magento merchants should check their hosting control panel or ask their host. Sansec advises that on servers running PHP-FPM, the version should be confirmed from a live web request rather than the command line, as the two can differ.
PHP 8.1 and older won’t get an official fix from the PHP project. Some Linux distributions and long-term support vendors offer backported patches, though moving to a supported version is the safer route. PHP 8.2 reaches end of life on 31st December 2026, and WooCommerce recommends PHP 8.3 or newer.
STAY AHEAD OF UK ECOMMERCE
Found this useful? This is one of dozens of updates like it we track every week. Get the ones that matter to UK sellers in your inbox, twice a week – free.
If you can’t update straight away
PHP has published temporary mitigations alongside the release, but says only the update fully fixes the problem.
For organisations that can’t update or apply the mitigations, the UK National Cyber Security Centre advises they consider taking the system offline until they can.
Switching on maintenance mode won’t protect a store. Sansec found that the maintenance modes in WordPress and Magento offer no protection, because PHP processes each request before the store checks whether it’s in maintenance mode. To take a store offline properly, PHP has to be stopped and the web server set to show a static holding page.
Sansec has also published web server rules that either block the type of request used in the known attacks or restrict a store to browsing only. Neither is free of side effects.
Check for signs of compromise
Because attacks started before the fix was released, updating PHP doesn’t guarantee a store hasn’t already been compromised. The NCSC advises checking systems for evidence of compromise and backdoors. Businesses that can’t do that themselves can use an NCSC-assured incident response provider.
Sansec found that CVE-2026-109618 can also leak server memory, which may contain passwords, session tokens and API keys. Self-managed stores that were exposed should consider changing admin passwords and rotating API keys for payment gateways and other connected services once PHP is updated.
Magento stores need two fixes
Adobe released a separate critical security update for Adobe Commerce and Magento Open Source on 13th October. Magento merchants need that update and the PHP fix in place.
As of 22nd October, Adobe had not published guidance on the PHP flaws for Adobe Commerce or Magento Open Source.
