PHP2Shell: What We Patched and What You Need to Do

On October 21, 2026, the PHP security team released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both are rated 9.2 out of 10 under CVSS v4.0. They affect almost every site that runs on PHP, including online stores.

Here’s what the flaws do, what we’ve already done for stores hosted by X-Cart, and what to check if you run X-Cart on your own server.

Why This One Is Serious

Most vulnerabilities need something to line up: a weak password, an outdated plugin, a specific page. PHP2Shell doesn’t.

An attacker only needs to send one POST request with a file-upload body (multipart/form-data) to any PHP script on the server. PHP reads and parses that request before your store’s code even starts. So the attacker doesn’t need to log in, doesn’t need a vulnerable add-on, and doesn’t need to find a particular page.

If the attack works, the attacker can run their own code on the server with the permissions of the PHP process. In practice, that usually means:

• installing a web shell to keep access
• reading configuration files with database passwords, API keys and tokens
• using the server to reach other systems connected to it

For a store, that puts customer data, order data and payment integrations at risk.

Which PHP Versions Get a Fix

The PHP project only patches supported versions, which means PHP 8.2 and newer. Official fixes were released for those branches on October 21.

PHP 8.1 and older are past end of life, so PHP itself won’t release fixes for them. There is one important exception: Ondřej Surý, who maintains the widely used PHP packages for Debian and Ubuntu, has backported the fix to older branches, including PHP 7.4 and 8.0. The fix is listed in his package changelog as “Avoid state corruption via bailout” for CVE-2026-109618 and CVE-2026-109619.

For PHP older than 7.4, the fix is an upgrade.

What We’ve Done at X-Cart

We’ve applied patched PHP builds across X-Cart’s own sites and hosted stores:

• x-cart.com, market.x-cart.com and others
• X-Cart hosted stores running PHP 7.4 and newer
• trial stores
• CloudSearch

If your store is hosted by X-Cart and runs on PHP 7.4 or newer, it has been patched.

If your hosted store runs on X-Cart 5.5.0, 5.4 or below, we can fix that. We’ll upgrade your store to X-Cart 5.5.1 or 5.6.0 on a patched PHP version, and we’ll contact you to plan it. You don’t have to wait for us: email support@x-cart.com and we’ll get started.

If You Host X-Cart Yourself

If your store runs on your own server or with another hosting provider, patching is up to you or your host. Here’s the order to do it in:

1. Check Your PHP Version

Your hosting control panel shows it, or run php -v on the server. Check every site and subdomain separately; they can run different versions.

2. Update PHP

• On PHP 8.2 or newer: install the latest security release for your branch.
• On PHP 7.4 or 8.0 on Debian or Ubuntu: install the latest packages from Ondřej Surý’s repository, which include the backported fix.
• On PHP older than 7.4: upgrade PHP to a patched version.

3. Check Your X-Cart Version

X-Cart 5.5.0, 5.4 and below are no longer supported. If you’re on one of them, upgrade to X-Cart 5.5.1 or 5.6.0. Our team can do the upgrade for you.

4. If You Can’t Patch Today

As a temporary measure, some hosting providers disable session.upload_progress and restrict multipart/form-data POST requests. This lowers the risk but doesn’t remove it, and it can break file uploads and some forms in your store. Treat it as a stopgap until PHP is updated.

5. Look for Signs of Compromise

If your server ran an unpatched PHP version after October 21, check for unfamiliar PHP files in web-accessible folders, and change your database password and API keys.

Not Sure Where Your Store Stands?

Send us your store URL at support@x-cart.com. We’ll tell you which PHP and X-Cart versions you’re on and what it takes to get you onto a patched setup. If you’re on an unsupported version, we’ll handle the upgrade for you.