PHP2Shell and WooCommerce: What Store Owners Need to Do

As of 23 October 2026, the PHP project has fixed both PHP2Shell flaws in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and WooCommerce has said that no WooCommerce or WordPress update is required or planned for them. Exploitation attempts are widely reported, but confirmed successful compromises are not publicly documented, and CISA has not added the flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The short answer for store owners: your WooCommerce store is exposed only if the PHP on its server is unpatched. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of bugs in PHP itself, the language and server software that runs WordPress and WooCommerce. Updating WooCommerce, your theme or your payment plugins won't fix it. The fix happens on the server, which means your web host or whoever manages it.

This guide covers what WooCommerce said, how to check your PHP version, who patches, and store-specific details: upload limits, .htaccess settings and payment keys. For the WordPress side of the story, see our guide to PHP2Shell and WordPress.

What WooCommerce Said

WooCommerce published "Critical Security Releases for PHP" on its developer blog on 21 October 2026. The key lines:

• "These vulnerabilities are not specific to WooCommerce or WordPress and affect any server that hosts a PHP application. No WooCommerce or WordPress update is required or planned for these issues."
• "For WooCommerce stores hosted on Automattic infrastructure (WordPress.com, WordPress VIP, Pressable, and WP Cloud), your sites are already protected against the recently disclosed PHP security issues."
• For old PHP on self-managed hosting: "you should consider taking your server offline while you prepare to update to a newer version of PHP."

Was WooCommerce Tested by the Researchers?

Not by name. Wiz demonstrated remote code execution against WordPress, Drupal and Joomla using their official container images. Calif, which reported the first bug to PHP, lists WordPress 7.1.2 among 11 applications where it confirmed unauthenticated remote code execution. WooCommerce is not on either list.

That does not make a WooCommerce store safer. WooCommerce is a plugin that runs inside WordPress, on the same PHP process. If WordPress on an unpatched PHP build is exposed, so is the store running inside it. "Not named" means "not tested publicly," not "not affected."

WooCommerce PHP Requirements and Old PHP

WooCommerce's server requirements for WooCommerce 10.8 and later ask for "PHP version 8.3 or greater (tested up to PHP 8.4)." It still runs on PHP 7.4 and later, but warns that those older versions "have reached their official End of Life and may expose your site to security vulnerabilities."

Here is what that means for PHP2Shell, as of 23 October 2026:

If you need to move up a PHP branch, test your theme and every extension on a staging copy first. Payment, shipping and subscription extensions are the ones most likely to break.

How to Check Your Store's PHP Version

You can see the PHP version in two places inside WordPress:

1. Site Health. Go to Tools > Site Health, open the Info tab and expand Server. WooCommerce points store owners here in its PHP2Shell post.
2. WooCommerce System Status. Go to WooCommerce > Status. The System Status report lists "PHP version" under Server Environment, along with PHP Post Max Size and PHP Max Input Vars.

Read the number with care. Distributions such as Ubuntu and AlmaLinux backport security fixes without changing the upstream version, so a patched server can still report something like 8.3.6. The number alone can't prove you are patched or vulnerable, so ask your host in writing. Our guide on how to check your PHP version covers the hosting panel and command line too.

Who Patches PHP for Your Store

If you manage the server, the update uses your normal package manager. A generic example for Debian or Ubuntu with PHP-FPM (replace 8.3 with your version):

sudo apt update
sudo apt upgrade
sudo systemctl restart php8.3-fpm

On Apache with mod_php, restart Apache instead. The restart matters: workers that are already running keep the old code until they are replaced. For exact wording to send your host, use our list of questions to ask your host about PHP2Shell.

Why WooCommerce Updates and Security Plugins Can't Fix It

Keep WooCommerce and your extensions updated, but it won't help here. On Apache with mod_php, PHP's advisory says the first flaw is reached "entirely before any application-specific code begins execution." Security and firewall plugins load after that point, so they cannot block it. Our overview of WordPress security plugins explains what they do cover.

A WAF run by your host or a CDN filters requests before they reach PHP. It is a useful extra layer while you patch, not a fix, and it can be bypassed if your server is reachable directly by its IP address.

Don't Treat .htaccess PHP Settings as Protection

WooCommerce's requirements page tells merchants they "can also manually adjust PHP settings such as post_max_size, max_input_vars, and max_execution_time in the .htaccess file." That is tuning advice, not a PHP2Shell mitigation, and it touches one of the attack paths.

PHP's advisory for CVE-2026-109619 notes that on Apache with mod_php, .htaccess and php_value settings are "applied before php_request_startup()." One confirmed path involves a setting that produces a warning, notice or deprecation during that early stage. PHP's official mitigation is to "Remove invalid or deprecated settings applied per request that emit diagnostics before initialization," and it adds that "Hiding diagnostics with error_reporting, display_errors or @ does not help."

What this means in practice:

• Have your developer or host review any php_value or php_flag lines in your .htaccess files and remove ones that are invalid or deprecated for your PHP version.
• Don't add PHP2Shell mitigations to .htaccess, .user.ini or a plugin. PHP says to use php.ini, the PHP-FPM pool or server configuration, and "Do not rely on ini_set() or FPM .user.ini."
• If your host applies a lower post_max_size as a stopgap, test product image uploads, CSV imports and checkout. PHP suggests 8M for sites without uploads and 32M with them.

Our guide to PHP2Shell interim mitigations covers each official setting and what it can break.

Payment Gateway Keys and Customer Data

Stores hold payment gateway API keys, webhook secrets and customer order data. Wiz warns that memory leaked through PHP2Shell "may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself." Beazley's advice for anyone who suspects compromise is to "treat secrets held by an affected PHP process as potentially exposed."

The NCSC-NL software list lists WooCommerce itself and several payment extensions, including WooCommerce Stripe Payment Gateway and WooCommerce PayPal Payments, as "Investigation." That means the PHP link is known but no CVE match is confirmed, not that those plugins have a bug.

A sensible order:

1. Patch PHP and restart every worker first, or new keys are exposed too.
2. Check for signs of compromise, starting your log review no later than 17 October 2026. Our guide on whether your site was hacked lists what to look for.
3. If anything looks wrong, or you can't rule it out, rotate payment gateway API keys and webhook secrets in each provider's dashboard, then change admin passwords.

PCI DSS questions, such as how this affects your self-assessment, are covered in our guides to PCI DSS 4.0 and your website and PHP2Shell for online stores.

Conclusion

As of 23 October 2026, PHP2Shell reaches WooCommerce stores only through the PHP they run on, and WooCommerce has said no WooCommerce or WordPress update is planned for it. Confirm your PHP build is patched and restarted, get off PHP 8.1 or older, clean up per-directory PHP settings rather than adding new ones, and protect your payment keys if anything looks wrong. If you manage your own server and need help patching quickly, see our emergency PHP patching service. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions