PHP2Shell statement record · Platform
Status in the company's own words: customer must update. Statement dated Oct 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on build.prestashop-project.org, dated Oct 21, 2026. Source type: official page.
Post Critical PHP security updates: what PrestaShop users need to know
by Krystian Podemski (VP of Technology & Community, PrestaShop) on the project's build blog names CVE-2026-109618 and CVE-2026-109619 (php2shell, CVSS 9.2). Updating PrestaShop or your modules will not fix this.
and An update that is installed but not loaded does not protect you.
quoted from the statement URL. Merchants to confirm with their host, in writing, that the running PHP has the fix; self-managed servers install the PHP update and restart every PHP process (PHP-FPM pools, Apache, LiteSpeed, FrankenPHP workers). PHP 8.1 and older no longer get official updates (backports exist for 7.4, 8.0, 8.1); PHP 8.2 EOL 31 Dec 2026; PrestaShop 9 recommended. Docker users told to rebuild on the updated base image.
no status named
Yes—PrestaShop stores running unpatched PHP are affected, but the flaws are in PHP itself, not PrestaShop. PrestaShop’s official advisory covers CVE-2026-109618 and CVE-2026-109619 and says all PrestaShop versions, from 1.6 through 9, are concerned because they run on PHP. Has it been patched? PHP fixes were released on October 21, 2026. There is no PrestaShop-specific patch: updating PrestaShop or
no status named
Based on the search results, I was unable to find any PrestaShop-specific advisory, patch, or statement regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Here is what is known about PHP2Shell and how it relates to PrestaShop: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and PrestaShop What is PHP2Shell? The PHP development team released emergency security updates to fix PHP2Shell — two critical vulnerabilities (CVE-2026-109618
no status named
Yes—PrestaShop installations are potentially affected, but the vulnerability is in the PHP runtime, not in PrestaShop’s application code. Any PrestaShop store running an unpatched PHP version that serves web requests is at risk. Patch status: PHP released fixes on October 21, 2026: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 PHP 7.4–8.1 have source backports but no standard official
no status named
Yes, PrestaShop sites are affected if they run on a vulnerable PHP runtime version, because PHP2Shell is a flaw in the PHP engine itself rather than a bug in PrestaShop's own application code. The PHP project released emergency patches on October 21, 2026, to fix both vulnerabilities. To protect your store, your server administrator or hosting provider must update
no status named
Yes, PrestaShop is indirectly affected because it is a PHP-based application. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 (jointly known as PHP2Shell) are severe, memory-handling flaws residing in the PHP core runtime engine, not within PrestaShop's own application code. Because the flaw exists in PHP itself, virtually every PrestaShop store is vulnerable if the underlying server environment runs an unpatched PHP
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for PrestaShop reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
PrestaShop's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about PrestaShop and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy