PHP fixes two critical vulnerabilities on October 21 at 14:00 UTC. They affect all web servers running PHP 5.4 or later. You need to fix them at the infrastructure level. Sansec expects mass attacks within 15 minutes of the release.
PHP will release a fix for two critical vulnerabilities on Wednesday October 21 at 14:00 UTC (16:00 CEST, 10:00 EDT). The PHP security team rated both CVSS v4.0 9.2. A screenshot of an exploit tool named PHP2Shell, credited to Calif.IO , leaked alongside the advisory. Its banner claims the tool works against every PHP release from 5.4.0 on. The bugs affect all web servers running PHP 5.4 or later, which includes Magento, Shopware and WooCommerce stores.
We expect mass attacks to start within 15 minutes of the release.
Information the embargoed bugs leaked on October 20. Security firm watchTowr confirmed that they are remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP will publish technical details and the fixed versions with the release. PHP reserves the right to release earlier if details become public or attacks start.
You need to fix PHP2Shell at the infrastructure level, by updating PHP on your servers. You cannot fix it from within your store codebase.
If you do not manage your web server stack, ask your hosting provider today to stand by and apply the PHP update as soon as it is released.
PHP only supports version 8.2 and later. Servers on PHP 8.1 or older will not get an official fix. Ask your provider to backport the fix or move you to a supported PHP version.
If possible, we will release an application-level mitigation in Sansec Shield . From what we know so far, the attack targets PHP itself, before your store code and Shield run. Do not wait for a Shield rule to protect you.
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
PolyShell: unrestricted file upload in Magento and Adobe Commerce
Critical backdoor found in MGT Varnish extension
SessionReaper attacks have started, 3 in 5 stores still vulnerable
Block all known Magento attacks, while you schedule the latest critical patch until a convenient moment. No more downtime and instability from rushed patching.
Scan your store now for malware & vulnerabilities
eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce, Sylius and many more.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
