Does the October 2026 PHP vulnerability affect WooCommerce and Magento stores?

It affects any store whose server runs a vulnerable PHP build, whichever cart sits on top. The safe releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; anything lower in the same branch is exposed. Stores on Apache with mod_php are the most urgent, because the attack lands before your store code runs.

Will patching PHP break my checkout?

Moving within a branch, such as 8.3.35 to 8.3.36, is a security release rather than a version jump, so breakage is unlikely. The genuine risk is an unplanned branch upgrade away from end-of-life PHP 8.1, which can disturb older extensions. Pick a quiet window, patch, then place one real order to confirm.

What should I test after patching PHP on my store?

Buy something from yourself: one real order with a real card, start to finish. Then confirm the payment webhook landed, the confirmation email arrived and the invoice generated, because those three fail quietly. Restart PHP-FPM before testing so workers stop serving the old binary, and clear the application cache.

PHP RCE October 2026: Patch Your Store Without Losing Orders

October 22, 2026 3 min read

Dark banner reading 'Patch the engine without stalling checkout' beside two cards: vulnerable PHP builds above, the patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 below

Your store is a car with passengers in it, and the engine needs work while it is moving. Nobody gets to pull over: orders keep arriving, the payment provider keeps calling your webhook, and a broken checkout costs you money in a way that a patch note never will. So the job is not only applying an update. It is applying it in an order that leaves checkout standing afterwards.

Why the cart software is beside the point

Two vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an attacker run their own code on your server without logging in to anything. Patched builds appeared on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Below those numbers in the same branch, you are exposed regardless of how current your cart, theme and extensions are.

Remote code execution on a storefront is not a downtime story. Whoever has it can edit the page where your customers type card details, read orders and quietly change where money goes. If the server runs Apache with mod_php, the attack lands before your store code starts, so admin logins and checkout hardening never enter into it.

Running PHP 8.1 or older makes this a bigger project. Those branches are end-of-life, no patch exists for them, and the fix is moving the store to 8.2 or newer.

A window that does not cost you a basket

Pick the hour with your lowest order volume, then work in this sequence: snapshot or back up, confirm your extensions run on the target version, apply the patch release within the same branch, restart PHP-FPM so workers pick up the new binary, and clear the application cache. Install only from php.net, your distribution’s repositories or your hosting provider’s own update channel.

Then buy something from yourself. One real order, one real card, start to finish. Watch the payment webhook land, the confirmation email arrive and the invoice generate, because those are the three things that fail quietly.

Verify the version you are actually running

Admin panels cache their system reports and will happily lie to you. Read this script, then run it on the server:

curl -fsSL https://blog.limewire.com/content/files/2026/10/php-exposure-check.txt -o php-exposure-check.sh
less php-exposure-check.sh
sh php-exposure-check.sh

Checksum, SHA-256: c13cd5690c9d352c6a95e854602be2f330a0799435c05a8261037401fcf50255. It finishes with 0 if everything it found is patched, 1 if anything is vulnerable or end-of-life, 2 if it found no PHP. There is a mirror of the same file hosted here on LimeWire from our verified @limewireofficial account — nothing to sign up for, no cap on downloads, and the link stays alive.

The long version, with the container images, distribution packages and the versions that are safe per platform, lives in our full write-up of this CVE pair. Read it before your next maintenance window, not during one.

For the record: we had no hand in this PHP flaw whatsoever. Our relevant experience is older and more embarrassing, from the years when a file called track04.mp3.exe could ruin a teenager’s weekend via our software. We grew up. PHP core is somebody else’s weekend.