PHP2Shell: what happened and what we are doing for your store

In short: two critical vulnerabilities in PHP, nicknamed “PHP2Shell”, became public on 20 October 2026. PHP released a fix on 21 October and we are rolling it out across every HDL Commerce environment right now. You do not need to do anything for your HDL-hosted store.

What happened

PHP is the programming language behind a large share of the web, including WordPress, Magento, Drupal and many custom platforms. Two flaws were found in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical, 9.2 out of 10.

The PHP security team had planned a coordinated release. Details leaked a day early, on 20 October, which gave attackers a head start.

• 20 October — vulnerability details leak ahead of the planned disclosure.
• 21 October, 16:00 CEST — PHP releases the official security update.
• 21 October — we begin rolling it out across all HDL Commerce environments.

Why it matters

On an unpatched server, an attacker can run their own code without logging in. That means stolen data, injected malware, or a store taken offline.

Because the flaw sits in PHP rather than in any single plugin or platform, application-level firewalls cannot fully block it. Updating PHP is the only confirmed fix.

A working exploit exists publicly, and researchers have demonstrated unauthenticated remote code execution against Magento 2.4.9. How much exploitation is actually happening in the wild is disputed between security vendors — some report sightings, others have confirmed no indicators of compromise. We are treating it as actively exploited until shown otherwise.

What we are doing

• We have followed the incident from the first warnings and prepared our servers ahead of the release.
• We are currently applying the official PHP update across all HDL Commerce environments. We will update this post when the rollout is complete.
• We have reviewed logs and traffic for signs of exploitation. We found none.

We have seen no impact on stores, admin, integrations or data. The review continues while the rollout runs, and we will contact you directly if that changes.

What you need to do

Nothing for your HDL-hosted store. We handle PHP updates as part of our hosting and operations.

If you run your own systems outside HDL’s hosting — an ERP connector, internal tools or another website on a separate server — ask whoever manages those servers to update PHP as soon as possible. The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We are happy to help you check.

Questions

Contact us at [email protected] or reply to the email you received from us. If anything on your store behaves unexpectedly in the coming days, tell us right away.

Pierre Grönberg, CEO, HDL Group