--- title: "PHP2Shell Critical Flaws: what it means for your website, and why StoreConnect is not affected" source: https://storeconnect.com/articles/news/php2shell-what-it-means-for-your-website-and-why-storeconnect-is-not-affected type: article format: markdown site: StoreConnect — Customer Commerce built natively on Salesforce site_index: https://storeconnect.com/llms.txt docs_index: https://support.storeconnect.com/llms.txt note: Append .md to any page or article URL on this site to get its Markdown form. --- # PHP2Shell Critical Flaws: what it means for your website, and why StoreConnect is not affected On October 21, 2026, at 14:00 UTC (midnight on October 22 in Brisbane), the PHP project released emergency fixes for two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. Together they are known as PHP2Shell, and [each is rated 9.2 out of 10 on the CVSS v4.0 scale](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/){:target="_blank"}. The flaws let an attacker run their own code on a web server without logging in. The US Cybersecurity and Infrastructure Security Agency (CISA) says they [affect all PHP installations serving web requests](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching){:target="_blank"}. Australia's Cyber Security Centre (ACSC) has issued a [critical alert](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php){:target="_blank"}, and attackers moved fast: [Cloudflare reported attack traffic](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities){:target="_blank"} before the fix was even released, and security researchers now report [exploitation in the wild at scale](https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619){:target="_blank"}. Our goal here is simple. PHP powers a huge share of the web and its maintainers responded quickly. Whatever platform you run, we want you to have the facts and the right resources to close this gap. ## Your StoreConnect store is not exposed to PHP2Shell PHP2Shell lives in the PHP engine, so it can only reach systems that run PHP. StoreConnect does not. 1. **No PHP in the platform.** StoreConnect's storefront, customer portals and point of sale are not built on PHP and do not run a PHP engine, so there is nothing for these flaws to attack. 2. **Your data lives in Salesforce.** Customer records, orders, products, pages and configuration [reside in your Salesforce org](https://storeconnect.com/solutions/security), not in a separate storefront database sitting on a web server. 3. **We run the infrastructure, so you don't patch it.** StoreConnect [handles security, compliance and hosting](https://storeconnect.com/articles/blogs/Why-I-would-not-buy-StoreConnect-for-its-commerce-features) for every store. There is no server, runtime or plugin stack on your side waiting for an urgent update. 4. **No plugin layer to chase.** Themes are built with [Liquid templating](https://support.storeconnect.com/articles/working-with-liquid){:target="_blank"}, and custom logic runs server-side on the platform rather than through third-party plugins that each need their own patching. 5. **Independently audited.** StoreConnect holds SOC 2 Type I, SOC 2 Type II, SOC 3, ISO 27001:2022, PCI DSS 4.0.1, HIPAA and GDPR attestations. Reports and details are in our [Trust Center](https://trust.storeconnect.com){:target="_blank"}. This doesn't make any platform immune to every future flaw. It does mean that when a vulnerability like this one lands, the patching work sits with us, not with you, your agency or your host. ## Your store may be safe, but the systems around it might not be Any website, portal or web app running PHP is in scope until it is patched. That includes sites built on WordPress, Drupal, Joomla, Magento, WooCommerce, Shopware and Laravel. Researchers have [demonstrated attacks before login on WordPress, Drupal and Joomla](https://www.wiz.io/blog/php2shell-php-rce){:target="_blank"}, and [confirmed the same against Magento](https://sansec.io/research/php2shell){:target="_blank"}, because the flaw sits underneath the application. A site with perfectly clean code is still exposed if the PHP version beneath it is old. For StoreConnect customers, the risk usually sits in the systems next to your store. Check for: 1. A marketing blog or content site on WordPress or Drupal 2. Campaign microsites, landing pages and event sites, including old ones nobody has touched in years 3. Staging, test and development copies of any PHP site 4. Intranets, booking tools, survey tools and partner portals 5. Custom integrations or middleware your agency hosts that pass data into Salesforce or your store Three things make this one harder than a normal update cycle: - **Passwords and MFA don't help.** A single crafted web request [can trigger the attack before any application code runs](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/){:target="_blank"}. - **Secrets may already be exposed.** Researchers showed attackers can read PHP worker memory, which [can expose passwords, authentication tokens and API keys](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities){:target="_blank"}. - **The fix is at server level.** You [cannot fix PHP2Shell from inside your application code](https://sansec.io/research/php2shell){:target="_blank"}, so CMS auto-updates won't cover it. It depends on your host, agency or IT provider, and their patching speed becomes your exposure window. ## Every hour unpatched widens the window, so start today The goal is to find every PHP system you own, get it patched and get that confirmed in writing. **Today** 1. **List every PHP system.** Include live sites, staging copies, microsites, portals and any tools your agency hosts for you. If you're not sure what a site runs on, ask whoever built it. 2. **Get written confirmation of the PHP version.** Ask your host, agency or IT provider to confirm each system runs [PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching){:target="_blank"}, or a vendor back-port of the fix, and the date it was applied. 3. **Can't patch today? Take it offline.** Isolating an internet-facing PHP app is safer than leaving it exposed. Your IT team can also review the [temporary mitigations](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/){:target="_blank"}, but updating PHP is the only complete fix. 4. **Check for signs of a break-in.** Anything unpatched since October 21 should be checked for new admin accounts, unfamiliar files and unusual outbound traffic. **This week** 5. **Rotate credentials held by exposed systems.** Because memory can leak, change passwords, API keys and tokens stored on any PHP system that was unpatched. Prioritize keys that connect to Salesforce, your store, payment providers or email platforms. 6. **Look for backdoors.** Patching closes the door but doesn't remove anyone already inside. 7. **Plan your way off old PHP.** Official fixes cover PHP 8.2 and later. Anything older needs an upgrade plan with an owner and a deadline. 8. **Brief leadership.** Record where you were exposed, what was done, when and what risk remains. {: start="5"} **Before your next renewal or contract review** 9. **Keep the paper trail.** Dated confirmations from suppliers are useful evidence for auditors and cyber insurers. 10. **Review supplier terms.** Check whether your host and agency have agreed patch timeframes and a duty to tell you about incidents. {: start="9"} ## If you think a system has been compromised Acting in the wrong order can destroy the evidence you need, so follow these steps first. 1. **Don't wipe or rebuild yet.** Investigators and insurers need the evidence on the affected system. 2. **Notify your cyber insurer** through the incident hotline on your policy schedule. Late notice can complicate a claim. 3. **Report it.** In Australia, contact the ACSC on 1300 CYBER1 (1300 292 371) or through ReportCyber at [cyber.gov.au](https://www.cyber.gov.au){:target="_blank"}. In the US, report to [CISA](https://www.cisa.gov){:target="_blank"}. 4. **Check your notification deadlines** if personal information may be involved. In Australia, the Notifiable Data Breaches scheme allows up to 30 days to assess, APRA-regulated entities have 72 hours under CPS 234, and critical infrastructure assets under the SOCI Act can have as little as 12 hours. 5. **Tell us if any StoreConnect or Salesforce credentials were stored on the affected system.** Our [support team](https://support.storeconnect.com){:target="_blank"} will help you rotate them and review access to your store. ## Where to get reliable, up-to-date guidance This is a fast-moving situation, so go to the official sources for the latest advice. | Resource | Best for | | --- | --- | | [ACSC critical alert: PHP2Shell](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php){:target="_blank"} | Australian organizations, official advice and reporting | | [CISA alert: critical vulnerabilities in PHP](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching){:target="_blank"} | US organizations, patched version numbers | | [CSA Singapore alert AL-2026-151](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/){:target="_blank"} | A plain summary of both flaws and their impact | | [PHP project](https://www.php.net){:target="_blank"} | Official release notes and downloads | | [Help Net Security: who is affected](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/){:target="_blank"} | Which PHP server setups are at greatest risk | | [BleepingComputer: temporary mitigations](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/){:target="_blank"} | IT teams that need a stopgap while patching | | [Qualys: find, mitigate and patch](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities){:target="_blank"} | Detection and exposure scanning | | [Sansec: PHP2Shell for online stores](https://sansec.io/research/php2shell){:target="_blank"} | Teams running PHP-based ecommerce | | [Wiz Research: technical write-up](https://www.wiz.io/blog/php2shell-php-rce){:target="_blank"} | Security teams that want the full technical detail | ## Spend less time chasing patches across your stack Researchers used AI models to uncover flaws that had sat in PHP's code for years, and more discoveries like this are likely. Every separate system you run is another place a fix has to land before attackers arrive. With StoreConnect, your website, store, customer portal and point of sale run on one audited platform, with your data in Salesforce and the infrastructure managed for you. When the next critical alert lands, your team can focus on the business instead of chasing confirmations. [Visit our Trust Center](https://trust.storeconnect.com){:target="_blank"} to review our security certifications, or [book a demo](https://storeconnect.com/book-demo) to see how StoreConnect brings your digital channels together on Salesforce. ## References 1. "Critical vulnerabilities in PHP," Australian Signals Directorate, Australian Cyber Security Centre. [cyber.gov.au/alert/critical-vulnerabilities-in-php](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php){:target="_blank"} 2. "Critical Vulnerabilities in PHP Require Immediate Patching," Cybersecurity and Infrastructure Security Agency (CISA), October 21, 2026. [cisa.gov](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching){:target="_blank"} 3. "Critical Vulnerabilities in PHP (PHP2Shell)," Cyber Security Agency of Singapore, alert AL-2026-151. [csa.gov.sg](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/){:target="_blank"} 4. "PHP2Shell: Critical PHP vulnerabilities patched, update now!" Help Net Security, October 21, 2026. [helpnetsecurity.com](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/){:target="_blank"} 5. "PHP ships emergency patches for critical PHP2Shell flaws," BleepingComputer. [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/){:target="_blank"} 6. "Two Critical PHP Flaws Could Hand Attackers Your Web Servers," Qualys Threat Research, updated October 22, 2026. [blog.qualys.com](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities){:target="_blank"} 7. "PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)," Sansec. [sansec.io](https://sansec.io/research/php2shell){:target="_blank"} 8. "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet," Wiz Research. [wiz.io](https://www.wiz.io/blog/php2shell-php-rce){:target="_blank"} 9. "php2shell: Leaked critical PHP RCEs," Hadrian. [hadrian.io](https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619){:target="_blank"} 10. "Security & Compliance," StoreConnect. [storeconnect.com/solutions/security](https://storeconnect.com/solutions/security) 11. "Why I would not buy StoreConnect for its commerce features," StoreConnect. [storeconnect.com](https://storeconnect.com/articles/blogs/Why-I-would-not-buy-StoreConnect-for-its-commerce-features) 12. "Working with Liquid," StoreConnect Support. [support.storeconnect.com](https://support.storeconnect.com/articles/working-with-liquid){:target="_blank"} --- ## Follow StoreConnect - [Email Newsletter](https://storeconnect.com/c/lp-newsletter) - [LinkedIn Newsletter](https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7444956928444862464) - [YouTube](https://www.youtube.com/channel/UCngKdP2x8l1wcbAKW3tvU8g) - [LinkedIn](https://www.linkedin.com/company/storeconnect) - [X / Twitter](https://x.com/storeconnecthq) ## Popular Links - [Partners](https://storeconnect.com/partners) - [Become a Partner](https://storeconnect.com/become-a-partner) - [News](https://storeconnect.com/articles/news) - [Events](https://storeconnect.com/articles/events) - [Live Events](https://storeconnect.com/live-events) - [Feature Comparison](https://storeconnect.com/how-we-compare) - [Download a free trial](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FMkeKUAT) - [Book a Demo](https://storeconnect.com/contact) ## Documentation - [Help documentation](https://support.storeconnect.com/help-documentation) - [Videos & tutorials](https://support.storeconnect.com/videos-tutorials) - [Developer reference](https://support.storeconnect.com/developer-reference) - [Release notes](https://support.storeconnect.com/release-notes) - [Troubleshooting](https://support.storeconnect.com/troubleshooting) - [Trust Center](https://trust.getstoreconnect.com/) - [Status Page](https://status.storeconnect.com/) ## Contact - info@getstoreconnect.com - US +1 415 745 3230 - AUS +61 2 8365 2308 100 S Ashley Dr, Suite 600-2461 Tampa FL 33602-600 USA Level 22, Sydney Place 180 George Street Sydney, NSW, 2000, AUS ## Machine-readable - [Site index for agents](https://storeconnect.com/llms.txt): curated map of this site in llms.txt format - [Documentation index for agents](https://support.storeconnect.com/llms.txt): full technical and product documentation map Every page and article on this site has a Markdown rendering: append `.md` to its URL. Continue in Markdown: [Home](https://storeconnect.com/home.md) · [How we compare](https://storeconnect.com/how-we-compare.md) · [Partners](https://storeconnect.com/partners.md) · [Become a partner](https://storeconnect.com/become-a-partner.md) --- StoreConnect — https://storeconnect.com/articles/news/php2shell-what-it-means-for-your-website-and-why-storeconnect-is-not-affected