ALERTCritical PHP vulnerability · CVE-2026-109618 · CVE-2026-109619 · 21 Oct 2026
<?doiusephp?>

Is PrestaShop affected by the PHP security issue?

Yes.

PrestaShop runs on PHP, so every PrestaShop shop is affected until its PHP version is updated.

Find your PHP version: Advanced Parameters → Information.

Check your website

Not sure your website runs on PrestaShop? Our free check looks for PHP in a few seconds.

yourwebsite.comCheck →

What PrestaShop site owners should do

Who looks after your website?

We'll show the steps for your situation.

  1. 01

    Find out who looks after your website

    Usually a web host, a developer or an agency. Ways to find out:

    • check your invoices and bank statements for a hosting company or web agency
    • search your email for “hosting”, “domain” or the name of whoever built your website

    DONE WHENyou know who to contact.

  2. 02

    Send them the message below, today

    It explains what needs to happen: update PHP to a fixed version. Ask them to reply when it's done.

    DONE WHENthey've replied that they're on it.

  3. 03

    Get confirmation that it's fixed

    Ask them to confirm that your website now runs a fixed PHP version (at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on the version it uses). Also ask about any other websites or systems they run for you.

    DONE WHENyou have that confirmation in writing.

  4. 04

    Check your website still works

    Open your homepage and try your contact form, login and checkout. If something broke after moving to a newer PHP version, update PrestaShop and its modules, or ask your developer.

    DONE WHENyour important pages work as before.

  5. 05

    If it can't be fixed today

    Ask whoever looks after your website to apply PHP's temporary safety settings until the fix is in; they're listed in the section for developers below. If that isn't possible soon either, the NCSC advises considering taking the website offline: your host can show a maintenance page in the meantime.

  6. 06

    Have your website checked for a break-in

    Ask your host or developer to check, especially if the fix took more than a day. Signs you can spot yourself:

    • admin accounts you don't recognise
    • pages, links or files you didn't add
    • visitors being sent to other websites
    • a warning in Google like “This site may be hacked”

    DONE WHENthey've checked and found nothing, or cleaned it up.

Send this to your host or developer

Copy it into an email or support ticket.

Subject: Urgent: critical PHP security issue (CVE-2026-109618 / CVE-2026-109619)

Hi,

On 21 October 2026 a critical security issue in PHP was published (CVE-2026-109618 and CVE-2026-109619). It can allow attackers to take over a web server without logging in. The UK's National Cyber Security Centre advises acting immediately:
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Our website runs PrestaShop, which uses PHP. Could you please:

1. Let me know which PHP version our website, and any other system you manage for us, runs.
2. Update to a fixed PHP version (8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer). Please update PrestaShop and its modules first if a newer PHP version is needed.
3. If updating isn't possible right away, apply the PHP project's temporary mitigations (https://www.php.net/) or take the site offline until it's fixed.
4. Check the server for any signs of compromise.

Please let me know once this has been done.

Thank you!
For your developer or host: what to do, step by step+
  1. 1.

    Find every PHP that serves a website

    Check the PHP that the web server runs, not only the one on the command line: php -v in a terminal can show a different version. Include every way PHP runs behind a website (PHP-FPM behind Nginx or Apache, Apache's built-in mod_php, LiteSpeed, FrankenPHP), and don't forget containers, staging sites and other servers.

  2. 2.

    Update to a fixed release

    Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (one per supported version). Use your operating system's packages, a newer container base image, or your hosting panel. PHP 8.1 and older no longer get fixes: move to a supported version.

  3. 3.

    Restart PHP

    Restart PHP-FPM, Apache or LiteSpeed after updating. Processes that are already running keep the old, vulnerable code until they restart.

  4. 4.

    Check the fix is really active

    Confirm the version the website itself runs, for example with a temporary phpinfo() page that you remove afterwards. Some Linux distributions fix security issues without changing the version number: if so, check that the package's changelog mentions CVE-2026-109618 and CVE-2026-109619.

  5. 5.

    Can't update yet? Apply the temporary settings

    php.net lists temporary settings that reduce the risk until you can update. Among them: set memory_limit=-1 in the server configuration so scripts can't change it (this avoids the out-of-memory situation the attack relies on; keep an eye on memory use), lower the limits on request and upload sizes, and set session.upload_progress.enabled=0. Restart PHP afterwards. These settings reduce the risk; they don't replace updating.

  6. 6.

    Check for signs of a break-in

    Look for PHP files that were added or changed since 21 October 2026, admin accounts nobody recognises, new scheduled tasks (cron jobs), unexpected processes or outgoing connections, and out-of-memory errors in the PHP logs. If anything looks wrong: restore a clean backup, change all passwords and keys (including database passwords), and tell the website owner.

  7. 7.

    Afterwards: stop advertising the PHP version

    Set expose_php = Off, so responses no longer include an X-Powered-By: PHP/… header that tells attackers which version you run.

Severity: 9.2 out of 10 (CVSS 4.0). CVE-2026-109618 (remote code execution via out-of-memory corruption) · CVE-2026-109619 (remote code execution via stale global state)

Good to know

  • In the back office, go to Advanced Parameters → Information to see your PHP version, along with your shop and server details. Source ↗
  • PrestaShop 9 runs on PHP 8.1 up to 8.4 (9.0) or 8.5 (9.1). Update PrestaShop and its modules before moving to a newer PHP version. Source ↗

Questions & answers

Does updating PrestaShop fix the PHP security issue?

The fix is in PHP itself, which runs underneath your website software. Updating the software and its add-ons is good practice, but doesn't fix this issue: PHP has to be updated too.

How do I see which PHP version my shop uses?

Go to Advanced Parameters → Information in the back office.

Is my customers' data at risk?

The flaw can let attackers take over the server your shop runs on, which could expose orders and customer details. Update PHP quickly and have the server checked for signs of a break-in.

More: How to check if your website uses PHP · The October 2026 PHP security issue, explained

Other platforms: WordPress · WooCommerce · Joomla · Drupal · Magento · TYPO3 · Shopify · Wix · Squarespace

SOURCES