PHP2Shell.fyi Check a site

PHP2Shell on Magento and Adobe Commerce

This covers Magento Open Source and Adobe Commerce. PHP2Shell is a flaw in PHP, so a Magento shop is exposed when its PHP is not fixed. Magento patches and extension updates do not change PHP. You, your host or Adobe have to update PHP itself.

Last reviewed . Rules of .

What to do

  1. Find the PHP version that serves your shop (see below).
  2. Pick a fixed PHP release that your Magento release supports.
  3. Update PHP for both the web server and the command line, and make sure PHP restarts.
  4. Rotate secrets if the shop ran on unfixed PHP (see the notes below).

Find your PHP version

Adobe’s docs check the PHP version on the command line, not in the Admin.

php -v

This shows the command-line PHP, which runs bin/magento commands. The web server can use a different PHP and a different php.ini. Adobe’s docs show how to check each:

On Adobe Commerce on cloud infrastructure, the PHP branch is set by the type: php:<version> line in .magento.app.yaml.

Which PHP your Magento release supports

PHP support from Adobe's system requirements; fixed releases from php.net.
ReleasePHP branchesFixed releases to use
2.4.98.58.5.12
2.4.88.4, 8.38.4.27, 8.3.36
2.4.78.3, 8.28.3.36, 8.2.35
2.4.68.2, 8.18.2.35
2.4.58.1No fixed PHP release
2.4.48.1No fixed PHP release

Adobe publishes this table for Adobe Commerce releases. It gives no separate PHP table for Magento Open Source.

On 2.4.4 or 2.4.5: these releases support only PHP 8.1, and PHP 8.1 gets no new releases. The PHP security team published a source patch for 8.1, and some Linux vendors ship patched 8.1 builds. Ask your host or vendor for such a build now, and plan an upgrade to a Magento release that supports PHP 8.3 or newer.

On 2.4.6, use 8.2.35, not 8.1. PHP 8.2 security support ends on 2026-12-31.

How to update PHP

On shared or managed hosting, ask your host this:

Which PHP build serves my site, and does it include the fixes
for CVE-2026-109618 and CVE-2026-109619?

Then restart every PHP process and rebuild any containers, as described in after you update.

Notes for shops

A shop holds customer data and payment keys. The researchers showed that the flaw can leak passwords, login tokens, API keys and certificates from server memory. If the shop ran on unfixed PHP, rotate payment provider keys, integration tokens and other secrets after the update (our advice).

Magento often runs with a large memory_limit. The fixed PHP adds a hard memory limit, set by memory_hard_limit_percent. When this setting is not set, the hard limit is 2 × memory_limit up to 1G, and memory_limit + 1G above 1G. A process that reaches it stops at once, without shutdown handlers. If you set memory_limit=-1 as a stopgap, set a finite value again after the update.

What the checker can see

For Magento, the checker looks for:

Magento shows no version in these signs.

They tell the checker that PHP is probably in use. The verdict depends on the PHP version the server reports. See how the checker works.

Check your site

Run the php2shell.fyi checker on your shop. It makes at most three ordinary GET requests and shows every PHP signal it saw. It cannot see inside your server, so confirm the result with your host or Adobe.

Sources