A critical vulnerability in PHP itself is playing out worldwide today, dubbed PHP2Shell. Two flaws (CVE-2026-109618 and CVE-2026-109619) allow remote code execution without logging in, on virtually every PHP website. So not just Magento, but also WordPress, Shopware and custom tools. There is no incident at any of our customers right now. Update 14:15 CEST: Hypernode is taking the entire platform offline at 14:30 until the patch is installed, expected to last until 15:30. Below: what is going on, what Hypernode and we have done, and what you still need to check yourself.
Update 14:15 CEST: Hypernode takes the entire platform offline at 14:30
Hypernode has just decided to take the entire platform offline today at 14:30 CEST (12:30 UTC). All shops running on Hypernode, including those of our customers, will be unavailable for the duration of this emergency maintenance.
The reason: the PHP core developers have told Hypernode that this morning's mitigations are not sufficient to block both vulnerabilities. The only real fix is updating PHP. At the same time, security partners warn that exploits will be available within minutes of the patch being published, because patches are now analysed with AI and turned into working exploits. And because the details leaked, the release has been moved forward to 15:00 CEST (13:00 UTC). Hypernode cannot guarantee that the packages from their PHP security partner Freexian will be ready the moment the embargo lifts.
As soon as the patches are installed on your Hypernode, it comes back online. Hypernode expects the maintenance to last until 15:30 CEST. If the patches are delayed, it will take longer. Follow progress on the Hypernode status page.
We know a shop that is offline on a Wednesday afternoon hurts. But a shop that is closed for an hour is a lot cheaper than a data breach involving customer and payment data. Tweakers, the Dutch House of Representatives and the NCSC made the same call this morning. We stand behind this decision.
What is PHP2Shell?
The PHP security team has announced two critical vulnerabilities, collectively known as PHP2Shell. Both are rated CVSS 9.2 and both lead to remote code execution: an attacker can run code on the web server without an account or a click from an employee.
The difference with last month's StyleSmuggler: that flaw was in Magento. This one sits in the PHP core itself, in the layer that processes requests before your application even gets a turn. That is why a Magento or WordPress maintenance mode does not help: PHP parses the request before the application can check the flag. A WAF or a mitigation at the web server level is currently the only thing standing between the internet and your PHP process.
The name comes from an exploit tool that leaked alongside the advisory. According to its banner, it works against every PHP release from 5.4.0 onwards. Cloudflare reported the first attacks on PHP sites this morning at 07:43 UTC, before the official patch. Sansec expects mass attacks within fifteen minutes of the fix being published. Several Dutch sites, including Tweakers and the Dutch House of Representatives, went offline as a precaution around 10:35 UTC.
Which versions are affected?
All web servers running PHP 5.4 or later. In practice, that is every PHP website online right now.
PHP officially supports only 8.2 and later. If you are still running 8.1 or older somewhere, there will be no official fix for that version. That makes this the moment to upgrade or take the site offline, because a web server mitigation is a band-aid, not a solution.
The official patch was scheduled for today, Wednesday 21 October, at 14:00 UTC (16:00 CEST), but has been moved forward to 13:00 UTC (15:00 CEST) because the details leaked. Watch out if you run RHEL-based servers with packages from Remi: that repository will not publish an update today. You will need to fall back to distribution packages or build from source.
What Hypernode has done
Our hosting partner Hypernode was informed early through its security contacts at PHP and has been working on mitigations since Tuesday afternoon. Those were rolled out to all Hypernode environments this morning around 10:00 CEST, which includes our customers' shops. That was well before the first Dutch sites went offline.
As soon as PHP publishes the official patch, it will be installed on all servers immediately. Because the PHP core developers say those mitigations do not protect against both flaws, the platform goes offline at 14:30 CEST until the patch is in place (see the update at the top). Hypernode's engineers remain on standby until everything is updated.
What we are doing
- We are following the patch rollout and will verify today, per shop, that the patched PHP version is active.
- After the patch, we will run an extra malware scan on every environment, just as we did around StyleSmuggler.
- If we see anything out of the ordinary, you will hear from us straight away.
This is exactly why we run on Hypernode by default and keep Sansec Shield switched on for all our customers. With a flaw in PHP itself, there is no Magento patch to wait for. The question then is how quickly something blocks on your behalf, and how quickly you can tell whether anything got in.
What you need to do now
Are you our customer? Then you do not need to do anything for your Magento shop. Do keep in mind that your shop will be offline this afternoon from 14:30 CEST until the patch is installed, expected until 15:30.
One important question, though: do you run other PHP software next to your Magento shop with another host? Think of a WordPress site for your corporate pages, an intranet or a custom tool. Check with that host today whether the PHP2Shell patch is being applied. This flaw hits everything that runs PHP, and a WordPress site at a budget host is just as much of an entry point as your webshop.
Is your shop not hosted with us and are you still waiting for the patch? These are the mitigations Sansec and the PHP core developers recommend, in order of effectiveness.
- Take the site offline temporarily, or make it read-only by allowing only GET and HEAD at the web server. This is what PHP core developer Gina Peter Banyard recommends as the only real mitigation besides patching. Your application's maintenance mode does not help.
- Block multipart/form-data at the web server level (nginx return 403 or an Apache RewriteRule). This breaks file uploads, including product image uploads in the Magento admin, and possibly some checkout forms. Test an order afterwards.
- Put the site behind Cloudflare with the managed WAF rules enabled. Cloudflare itself calls this a stopgap. Make sure your origin only accepts traffic from Cloudflare IP ranges, otherwise an attacker simply goes around it.
- Set session.upload_progress.enabled to off and session.use_strict_mode to on in your PHP configuration (with PHP-FPM via php_admin_flag per pool, then reload). This is not sufficient on its own and has no effect when your sessions live in Redis or the database.
- Patch as soon as the release is out, then run a malware scan. The attacks were already running before the patch, so "patched" does not automatically mean "clean".
Questions about your own shop or that other PHP site? Call or email us, even if you are not a customer.
