PHP2Shell: patch PHP behind your Shopify app

PHP has released urgent fixes for two vulnerabilities that can allow remote code execution without authentication. If a Shopify app’s server runs PHP, its operator should check and patch that runtime now. Updating application dependencies alone is not evidence that the server is fixed.

The 21 October PHP advisory lists four fixed releases:

PHP says installations handling web requests are at risk, including PHP-FPM and Apache with mod_php. It identifies mod_php as the highest risk configuration. For older branches, check whether your distribution or support vendor supplies a backported fix, or move to a supported release; an old version number alone does not describe a vendor’s patch status.

What PHP2Shell refers to

The PHP Foundation’s explanation describes two related runtime failures. CVE-2026-109618 involves memory exhaustion interrupting the construction of internal data, which cleanup code can subsequently handle incorrectly. CVE-2026-109619 involves stale internal state being reused after the associated memory has been freed. These are engine problems, not a defect that changing a Shopify theme resolves.

The Foundation says remote code execution was demonstrated with default mod_php settings for the first flaw, before application code ran, and also through application code paths on PHP-FPM. Demonstrated exploitation in research should not be confused with a verified compromise of a particular merchant or app provider.

Laravel hosting: check who performs the update

Laravel’s response page, updated at 19:32 UTC on 21 October, says running Laravel Cloud applications were patched in place and new deployments use updated images. A deployment cancelled during the pause still needs to be submitted again.

Vapor’s native runtimes are updated; Laravel recommends redeploying to adopt them quickly. It says non-native runtimes require a new deployment. Hosting status can change, so consult the response page for your service rather than applying one platform’s assurance to another.

Forge’s advisory explicitly says its automatic security updates do not patch PHP. Update each installed PHP version on every server through the documented dashboard procedure, then restart long-running processes such as queue workers, Horizon, Octane and Reverb. The guide also explains how to check both the command-line runtime and PHP-FPM afterwards.

Package availability is a separate check: Laravel’s response page still noted an Ubuntu 24.04 exception at the time checked. Do not mark a server complete merely because an update command finished. Verify the installed fixed version or the package vendor’s explicit backport notice, and that the running workers have adopted it.

A useful completion record

Our suggested operational checklist is to record each PHP deployment, its owner, package or image source, patch evidence, restart time and a basic application health check. Include app dashboards and webhook services as well as the public website. For containers, confirm what was actually deployed rather than relying on a mutable image label.

Keep unresolved deployments visible to the incident owner. PHP says only updating is a complete solution; its temporary measures address particular attack paths. Read the current advisory before changing memory or request limits, and assess the availability implications with your infrastructure team.

Questions for Shopify merchants

Ask app vendors whether any service processing your store’s data runs PHP, whether all affected deployments have received the fix, and how they will notify you if they find suspicious activity. Request a dated answer about the service you use, rather than a generic security assurance.

This report does not establish a compromise of Shopify or any named app. We found no verified link between these PHP flaws and the checkout redirect incidents. Those incidents and Shopify’s wider app security checklist remain separate reporting.

The PHP Foundation’s release explanation, 21 October 2026

Read the original announcement on X if the embed does not load.