PHP2Shell Critical Flaws: what it means for your website, and why StoreConnect is not affected

On October 21, 2026, at 14:00 UTC (midnight on October 22 in Brisbane), the PHP project released emergency fixes for two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. Together they are known as PHP2Shell, and each is rated 9.2 out of 10 on the CVSS v4.0 scale.

The flaws let an attacker run their own code on a web server without logging in. The US Cybersecurity and Infrastructure Security Agency (CISA) says they affect all PHP installations serving web requests. Australia’s Cyber Security Centre (ACSC) has issued a critical alert, and attackers moved fast: Cloudflare reported attack traffic before the fix was even released, and security researchers now report exploitation in the wild at scale.

Our goal here is simple. PHP powers a huge share of the web and its maintainers responded quickly. Whatever platform you run, we want you to have the facts and the right resources to close this gap.

Your StoreConnect store is not exposed to PHP2Shell

PHP2Shell lives in the PHP engine, so it can only reach systems that run PHP. StoreConnect does not.

1. No PHP in the platform. StoreConnect’s storefront, customer portals and point of sale are not built on PHP and do not run a PHP engine, so there is nothing for these flaws to attack.
2. Your data lives in Salesforce. Customer records, orders, products, pages and configuration reside in your Salesforce org, not in a separate storefront database sitting on a web server.
3. We run the infrastructure, so you don’t patch it. StoreConnect handles security, compliance and hosting for every store. There is no server, runtime or plugin stack on your side waiting for an urgent update.
4. No plugin layer to chase. Themes are built with Liquid templating, and custom logic runs server-side on the platform rather than through third-party plugins that each need their own patching.
5. Independently audited. StoreConnect holds SOC 2 Type I, SOC 2 Type II, SOC 3, ISO 27001:2022, PCI DSS 4.0.1, HIPAA and GDPR attestations. Reports and details are in our Trust Center.

This doesn’t make any platform immune to every future flaw. It does mean that when a vulnerability like this one lands, the patching work sits with us, not with you, your agency or your host.

Your store may be safe, but the systems around it might not be

Any website, portal or web app running PHP is in scope until it is patched. That includes sites built on WordPress, Drupal, Joomla, Magento, WooCommerce, Shopware and Laravel. Researchers have demonstrated attacks before login on WordPress, Drupal and Joomla, and confirmed the same against Magento, because the flaw sits underneath the application. A site with perfectly clean code is still exposed if the PHP version beneath it is old.

For StoreConnect customers, the risk usually sits in the systems next to your store. Check for:

1. A marketing blog or content site on WordPress or Drupal
2. Campaign microsites, landing pages and event sites, including old ones nobody has touched in years
3. Staging, test and development copies of any PHP site
4. Intranets, booking tools, survey tools and partner portals
5. Custom integrations or middleware your agency hosts that pass data into Salesforce or your store

Three things make this one harder than a normal update cycle:

• Passwords and MFA don’t help. A single crafted web request can trigger the attack before any application code runs.
• Secrets may already be exposed. Researchers showed attackers can read PHP worker memory, which can expose passwords, authentication tokens and API keys.
• The fix is at server level. You cannot fix PHP2Shell from inside your application code, so CMS auto-updates won’t cover it. It depends on your host, agency or IT provider, and their patching speed becomes your exposure window.

Every hour unpatched widens the window, so start today

The goal is to find every PHP system you own, get it patched and get that confirmed in writing.

Today

1. List every PHP system. Include live sites, staging copies, microsites, portals and any tools your agency hosts for you. If you’re not sure what a site runs on, ask whoever built it.
2. Get written confirmation of the PHP version. Ask your host, agency or IT provider to confirm each system runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor back-port of the fix, and the date it was applied.
3. Can’t patch today? Take it offline. Isolating an internet-facing PHP app is safer than leaving it exposed. Your IT team can also review the temporary mitigations, but updating PHP is the only complete fix.
4. Check for signs of a break-in. Anything unpatched since October 21 should be checked for new admin accounts, unfamiliar files and unusual outbound traffic.

This week

5. Rotate credentials held by exposed systems. Because memory can leak, change passwords, API keys and tokens stored on any PHP system that was unpatched. Prioritize keys that connect to Salesforce, your store, payment providers or email platforms.
6. Look for backdoors. Patching closes the door but doesn’t remove anyone already inside.
7. Plan your way off old PHP. Official fixes cover PHP 8.2 and later. Anything older needs an upgrade plan with an owner and a deadline.
8. Brief leadership. Record where you were exposed, what was done, when and what risk remains.

Before your next renewal or contract review

9. Keep the paper trail. Dated confirmations from suppliers are useful evidence for auditors and cyber insurers.
10. Review supplier terms. Check whether your host and agency have agreed patch timeframes and a duty to tell you about incidents.

If you think a system has been compromised

Acting in the wrong order can destroy the evidence you need, so follow these steps first.

1. Don’t wipe or rebuild yet. Investigators and insurers need the evidence on the affected system.
2. Notify your cyber insurer through the incident hotline on your policy schedule. Late notice can complicate a claim.
3. Report it. In Australia, contact the ACSC on 1300 CYBER1 (1300 292 371) or through ReportCyber at cyber.gov.au. In the US, report to CISA.
4. Check your notification deadlines if personal information may be involved. In Australia, the Notifiable Data Breaches scheme allows up to 30 days to assess, APRA-regulated entities have 72 hours under CPS 234, and critical infrastructure assets under the SOCI Act can have as little as 12 hours.
5. Tell us if any StoreConnect or Salesforce credentials were stored on the affected system. Our support team will help you rotate them and review access to your store.

Where to get reliable, up-to-date guidance

This is a fast-moving situation, so go to the official sources for the latest advice.

Spend less time chasing patches across your stack

Researchers used AI models to uncover flaws that had sat in PHP’s code for years, and more discoveries like this are likely. Every separate system you run is another place a fix has to land before attackers arrive.

With StoreConnect, your website, store, customer portal and point of sale run on one audited platform, with your data in Salesforce and the infrastructure managed for you. When the next critical alert lands, your team can focus on the business instead of chasing confirmations.

Visit our Trust Center to review our security certifications, or book a demo to see how StoreConnect brings your digital channels together on Salesforce.

References

1. “Critical vulnerabilities in PHP,” Australian Signals Directorate, Australian Cyber Security Centre. cyber.gov.au/alert/critical-vulnerabilities-in-php
2. “Critical Vulnerabilities in PHP Require Immediate Patching,” Cybersecurity and Infrastructure Security Agency (CISA), October 21, 2026. cisa.gov
3. “Critical Vulnerabilities in PHP (PHP2Shell),” Cyber Security Agency of Singapore, alert AL-2026-151. csa.gov.sg
4. “PHP2Shell: Critical PHP vulnerabilities patched, update now!” Help Net Security, October 21, 2026. helpnetsecurity.com
5. “PHP ships emergency patches for critical PHP2Shell flaws,” BleepingComputer. bleepingcomputer.com
6. “Two Critical PHP Flaws Could Hand Attackers Your Web Servers,” Qualys Threat Research, updated October 22, 2026. blog.qualys.com
7. “PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619),” Sansec. sansec.io
8. “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet,” Wiz Research. wiz.io
9. “php2shell: Leaked critical PHP RCEs,” Hadrian. hadrian.io
10. “Security & Compliance,” StoreConnect. storeconnect.com/solutions/security
11. “Why I would not buy StoreConnect for its commerce features,” StoreConnect. storeconnect.com
12. “Working with Liquid,” StoreConnect Support. support.storeconnect.com