On 21 October 2026, the PHP team released emergency updates for two vulnerabilities rated critical (9.2 out of 10). They let a stranger, without any password, run their own code on the server. PrestaShop runs on PHP: every shop is affected until its server is updated.
What is happening
The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619. They affect PHP itself, not PrestaShop or a module: your shop version and installed modules make no difference. An attacker exploiting them can read your database (customers, orders, addresses), plant malware or tamper with your payment page.
When a flaw this serious becomes public, hacking bots start testing it on thousands of sites within days. Do not wait.
Am I affected?
In your shop's back office: Advanced Parameters › Information, line "PHP version". Compare with this list:
- PHP 8.5: fixed from 8.5.12
- PHP 8.4: fixed from 8.4.27
- PHP 8.3: fixed from 8.3.36
- PHP 8.2: fixed from 8.2.35 (this branch is no longer maintained after 31 December 2026)
- PHP 8.1, 8.0, 7.x: no official fix. Some hosts provide one themselves: ask them.
If your version is lower than the one listed, your shop is exposed.
Free check: test your shop in 20 seconds (HTTPS, visible PHP version, exposed files, email), no sign-up.
What to do
- Shared hosting: the update is usually done by your host. Check your version in a few days; if it has not changed, write to support quoting both CVE numbers.
- Server you manage yourself: install the fixed release of your branch and restart PHP.
- Older shop on PHP 7 or 8.0: now is the time to plan a move to a maintained version. First check that your PrestaShop version and modules support it.
Workaround settings exist, but PHP says it clearly: only updating truly protects you.
Be warned next time
Alerts like this come several times a year, for PHP, PrestaShop and modules. Our Vigie module compares your shop every day with the public list of known vulnerabilities — PHP included — and emails you as soon as one concerns you, with what to do, explained in plain language.
Source: official PHP announcement, 21 October 2026 (php.net).