$ patchitfast scan --cve=CVE-2026-109618,CVE-2026-109619 --target=jouwshop.nl
PHP2Shell: critical, and it hits almost every PHP shop.
CVE‑2026‑109618 and CVE‑2026‑109619 (CVSS 9.2) affect every PHP build from version 5.4 onward. Below: what it is, whether you’re vulnerable, and what to do now.
Scan my shop for freeWhat PHP2Shell actually is
PHP2Shell is the nickname for CVE‑2026‑109618 and CVE‑2026‑109619. Security researchers (including watchTowr, Sansec) confirmed remote-code-execution vulnerabilities; assigned CVSS score: 9.2 (critical). Public reporting says this affects every PHP version from 5.4 onward.
Are you vulnerable?
Does your shop run on Magento, Shopware or WooCommerce? Then under the hood it runs on PHP — and so it’s at risk, regardless of how recent your platform version is. The vulnerability sits in the PHP layer itself, not in the webshop code. Our free scan confirms within minutes whether your exact PHP version and configuration are exposed.
What to do: patch at infra level
You don’t have to wait for a full PHP core upgrade. The chain can be closed at infra level — via php.ini directives, a targeted FPM pool configuration, or a WAF rule that blocks the vulnerable call. That closes the gap now, independent of your regular maintenance cycle for the core upgrade itself.
- 01PHP version and configuration scanned
- 02vulnerable call shielded at infra level
- +PHP2Shell patched, shop stays online
patchitfast’s approach on 21‑10‑2026
When PHP2Shell broke, the team behind patchitfast immediately mapped its own PHP infrastructure, applied mitigations and shielded non-critical services — ready to patch as soon as the official fix landed. That approach — map it, shield it, patch it once the fix exists — is what patchitfast delivers as a service.
verdict: READY TO PATCH once the fix lands
Are you exposed — and what now?
The facts above say the risk exists. They don’t say whether your exact PHP version and configuration are exposed right now. Our free scan checks that within minutes, specifically for CVE‑2026‑109618 and CVE‑2026‑109619 — and the rest of your stack.
Asking for Managed patch? Your first critical patch within the agreed SLA (plan under 1 hour, rollout under 4 hours) — or that month is free.
Scan my shop for freeFrequently asked questions
Am I vulnerable to PHP2Shell?
If your shop runs PHP 5.4 or higher (so almost every Magento, Shopware or WooCommerce install), you’re at risk until the patch is applied. Our free scan checks your exact PHP version and configuration and shows whether your stack is exposed.
Do I need to take my site offline?
Not necessarily. The patch works at infra level (php.ini, FPM pool, or a targeted WAF rule) and can usually be applied while your shop stays online. Taking it offline is only needed if active exploitation has already been observed on your environment.
How fast can patchitfast patch?
As soon as the official patch is available, we roll it out as fast as possible, with an audit log for CRA. For PHP2Shell, we already mapped and shielded our own infrastructure ahead of that.
Check if your shop is vulnerable to PHP2Shell
Leave your email address and shop domain. You’ll receive the scan report — including PHP2Shell status — as soon as it’s ready.