PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what it means for shipping teams
PHP2Shell is the name given to two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. On servers where PHP answers web requests, they can let an attacker who is not logged in run code on the machine. PHP released fixed versions on October 21, 2026, and public proof-of-concept exploits are already circulating, so any business that runs PHP should patch now.
ExperShip does not run PHP. The ExperShip app, API and this website are built on a different technology stack, so these two flaws do not affect ExperShip. The rest of this post explains the issue and what to check if your own store, website or tools use PHP.
What is PHP2Shell?
PHP is the language behind a large share of websites, online stores and plugins. The two flaws sit in how PHP cleans up after a web request:
- CVE-2026-109618: when PHP runs out of memory in the middle of a request, its cleanup step can treat half-built data as valid, which corrupts memory.
- CVE-2026-109619: data that belonged to one request can stay usable after it is freed, so a later request on the same worker can reach it.
Both are rated critical (CVSS v4.0 score 9.2). National cyber security agencies, including the Canadian Centre for Cyber Security and the Netherlands' NCSC, have published advisories asking organizations to find and update affected installations.
Which PHP versions fix it?
The October 21, 2026 releases fix both flaws:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Older branches such as PHP 7.4 are end of life and will not get a patch, so they need an upgrade to a supported version. A related third issue, CVE-2026-115560, is reported to be outside these fixes. Check the official PHP announcement for its status.
What should businesses that use PHP do?
- Find every PHP install. Include your online store, company website, plugins, internal tools and containers or appliances that bundle PHP.
- Update to a fixed version. If you use a hosting company or a hosted store platform, ask them to confirm they have patched.
- Use the temporary mitigation if you cannot patch today. Setting
session.upload_progress.enabled = 0in php.ini, the PHP-FPM pool or the Apache config blocks one confirmed attack path, though not every path. Setting it from code withini_set()or a.user.inifile comes too late. - Check your logs. Because exploits are public, review web server and PHP logs for unusual errors or requests since mid-October, and investigate anything unexpected.
- Ask your vendors. Order tools, marketplaces and plugins you rely on may run PHP even if you do not.
Is ExperShip affected?
No. ExperShip does not use PHP, so CVE-2026-109618 and CVE-2026-109619 do not apply to the ExperShip app, the API or expership.com. No action is needed on your ExperShip account.
A different stack does not mean zero risk, and we do not claim it does. Security depends on the whole environment: dependencies, hosting, access control and regular updates. ExperShip runs on AWS in the United States, with encryption in transit and at rest. You can read more on our security page.
If you connect ExperShip to a store or tool that runs PHP, that system needs to be patched on its own side. Patching it does not require any change in ExperShip.
Frequently asked questions
Is ExperShip vulnerable to PHP2Shell?
No. ExperShip does not run PHP, so these two PHP runtime flaws do not affect it.
Do I need to do anything in my ExperShip account?
No. Your labels, tracking and account settings are not affected. If your own store or website runs PHP, update it to a fixed PHP version.
My online store runs on PHP. Is my ExperShip connection at risk?
The risk sits on the store server, not in ExperShip. Patch the store or ask your hosting provider to confirm it is patched. If you think the store was compromised, rotate any API keys it holds, including your ExperShip API key.
Does using a platform that does not run PHP remove all security risk?
No. It removes this specific risk. Every platform still needs updated dependencies, careful access control and monitoring.
Who can I contact with a security question?
Write to us through the contact page and we will get back to you within one business day.