Security Update: Adobe Commerce Protections for Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Critical PHP2Shell Vulnerabilities Trigger Emergency Patches as Attack Activity Emerges
October 22, 2026 — Businesses running Adobe Commerce, Magento Open Source and other PHP-based web applications are being urged to review their server security following the disclosure of two critical PHP vulnerabilities that could allow unauthenticated attackers to execute arbitrary code remotely.
Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively known as PHP2Shell. Both carry a CVSS v4.0 severity score of 9.2 out of 10.
The PHP development team released emergency security updates on October 21, bringing forward the planned disclosure and patch release after information about the vulnerabilities leaked publicly. Amazon Web Services (AWS) subsequently reported exploitation attempts dating back to October 17 and said its threat intelligence had identified broader exploitation activity following public disclosure.
For ecommerce businesses, the immediate priority is to determine whether their PHP runtime is affected, apply the appropriate security fix and verify that their existing security controls are configured to reduce exposure.
Source: Official PHP security advisory | Source: AWS Security Blog
What Happened? Two Critical Vulnerabilities Affect the PHP Runtime
The newly disclosed flaws affect PHP’s internal handling of memory and request processing. Under certain conditions, carefully constructed HTTP requests can trigger unsafe memory-handling behaviour, potentially allowing an attacker to execute code, expose sensitive process memory or disrupt a service.
CVE-2026-109618 concerns memory corruption during out-of-memory error handling, while CVE-2026-109619 involves stale internal state that can refer to memory after it has been freed.
A key concern is that the vulnerable processing can occur before application-level code executes. As a result, normal application authentication may not be sufficient to prevent the attack.
The exposure is not limited to Magento. PHP web deployments using technologies such as PHP-FPM, Apache with mod_php, CGI and LiteSpeed are also within scope when running affected versions.
Security researchers and infrastructure providers have also reported attack traffic associated with PHP2Shell. AWS reported that exploitation attempts occurred before public disclosure and that additional attempts followed the release of the patches.
These reports make immediate remediation a priority, although they do not establish that every affected Adobe Commerce store has been targeted or compromised.
Emergency PHP Security Updates Are Now Available
The PHP project has released fixes for the following maintained branches:
PHP version branch | Fixed release |
PHP 8.5 | 8.5.12 |
PHP 8.4 | 8.4.27 |
PHP 8.3 | 8.3.36 |
PHP 8.2 | 8.2.35 |
Administrators should update to the appropriate fixed release or install a vendor-provided security package containing the relevant backported fix.
PHP 8.1 and older branches are outside normal upstream support. The PHP team has provided limited source backports for PHP 7.4, 8.0 and 8.1, while some operating-system distributions and long-term-support vendors may provide their own security packages. Businesses using these versions must verify the exact fix with their provider rather than assuming that the installation is protected.
The PHP project’s position is clear: a security update is the only complete remediation for these vulnerabilities.
What Does This Mean for Adobe Commerce and Magento Stores?
Adobe Commerce and Magento Open Source rely on PHP to process storefront requests, execute business logic and support ecommerce operations. A vulnerable PHP runtime may therefore expose a store even if its Magento core and extensions are up to date.
Potential consequences of a successful compromise include unauthorised server-side code execution, exposure of accessible customer or application data, credential theft, website disruption and interference with ecommerce operations.
The actual impact depends on the affected environment, permissions and accessible resources. A vulnerable PHP version indicates exposure, not proof that a breach has occurred.
For Adobe Commerce operators, the remediation process must account for the specific Commerce release, supported PHP versions and hosting environment. Installing a newer PHP version without checking compatibility can cause problems with application dependencies, extensions, scheduled tasks and other production services.
Businesses should verify their precise Adobe Commerce patch level and runtime configuration before applying changes.
Security Protections: What Cloud and WAF Users Need to Know
The emergence of PHP2Shell has also prompted security providers to strengthen network-level protections.
On October 21, Cloudflare reported that it had deployed managed Web Application Firewall (WAF) protections for PHP2Shell. The company said its protections were available by default to customers using Cloudflare WAF across its free and paid plans.
Fastly has also announced a virtual patch for the two vulnerabilities through its Next-Gen WAF offering. A virtual patch uses security rules to block relevant exploit traffic without changing the underlying vulnerable software.
These developments provide additional defensive options for organisations, but their availability must be assessed against the security products actually deployed.
Adobe Commerce on Cloud infrastructure has a documented Fastly-powered WAF for production environments. However, this should not be confused with Fastly’s separate Next-Gen WAF product, and the availability of a virtual patch in that product does not establish that the same protection is active on every Adobe Commerce Cloud deployment.
At the time of publication, Adobe’s public WAF documentation does not establish universal PHP2Shell-specific coverage for every Adobe Commerce environment. Cloud customers should contact Adobe Commerce Support to confirm the protection available to their specific deployment. Self-hosted Magento and Adobe Commerce operators should check their own CDN, WAF and hosting-provider controls.
WAF protection is an additional security layer, not a substitute for updating PHP.
Sources: Cloudflare’s PHP2Shell protection announcement | Fastly’s virtual patch announcement | Adobe Commerce WAF documentation
What Adobe Commerce Businesses Should Do Now
In response to the latest disclosure, businesses operating PHP-based ecommerce infrastructure should prioritise the following actions:
- Identify vulnerable runtimes: Check production web servers, PHP-FPM workers, containers, background services and other PHP components.
- Apply the appropriate security fix: Upgrade to a compatible patched version or verify a vendor-provided backport.
- Confirm WAF coverage: Establish whether relevant PHP2Shell protections are available and enabled for the actual hosting and security products in use.
- Review potential compromise: Examine server, application and security logs for suspicious requests, unexpected process execution, unfamiliar files and unusual outbound connections, including activity dating back to October 17.
- Validate the deployment: Test checkout, payment processing, customer accounts, APIs, scheduled tasks and integrations after remediation.
Any suspected compromise should be investigated separately from the patching process. Applying a security update does not establish that an earlier attack did not succeed.
Ceymox's Take: Treat PHP2Shell as an Urgent Infrastructure Security Priority
The PHP2Shell disclosure highlights the importance of securing the entire ecommerce technology stack, not just the Magento application layer.
For Adobe Commerce and Magento businesses, protecting production environments requires coordinated action across PHP runtimes, application compatibility, hosting infrastructure and perimeter security. A recent Magento update alone does not confirm that the underlying PHP runtime is secure.
Ceymox recommends that businesses review their affected environments immediately, coordinate runtime remediation with their hosting teams and verify the protection available through their deployed WAF and other security controls.
For businesses operating older or unsupported Commerce installations, this incident is also a timely reason to review platform compatibility, security maintenance and upgrade requirements.
Need help reviewing your Adobe Commerce security posture? Contact Ceymox to discuss PHP runtime remediation, platform compatibility and Adobe Commerce security planning.
Official References
- PHP: Critical remote code execution vulnerabilities — October 21, 2026
- AWS: PHP2Shell exploitation observed before public disclosure
- Cloudflare: Protections against PHP2Shell
- Fastly: PHP2Shell virtual patch
- Adobe Commerce: System requirements
- Adobe Commerce: Fastly WAF service
Last updated: October 22, 2026. Verify the latest vendor advisories and deployment-specific security guidance before making production changes.
