PHP2Shell and the Next.js Flaws of October 2026: Is Your Store Safe?
October 2026 brought two sets of critical web flaws, and attackers went after the PHP ones before the fix was even public. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) can let someone who is not logged in run code on a server that runs PHP. PHP fixed it on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A week earlier, on 14 October, Next.js fixed two critical remote code execution flaws and one denial of service flaw in versions 16.4.1 and 15.5.28. CISA, the US cybersecurity agency, put both PHP flaws on its list of actively exploited vulnerabilities on 26 October and gave US federal agencies until 29 October to patch.
If your store runs on WordPress with WooCommerce, PrestaShop, Magento, OpenCart, Laravel or any other PHP software on hosting you manage, this concerns you, and updating your plugins will not fix it. The PHP version under the store has to change. This guide explains what each flaw does, what an attacker can take from a cash on delivery store, how to check your versions and which release fixes what. Every date and version below comes from vendor advisories and security firms' reports, read on 29 October 2026.